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3 DOCUMENT OVERVIEW 





The audit was designed to be a comprehensive review of the results from the Maricopa County 2020 General Election to 
confirm the effectiveness of existing legislation in governing elections, and to provide additional insights on possible 
areas of information-based legislative reform that could ensure an even greater level of integrity and accuracy in how 
elections are conducted. 


This audit is the most comprehensive election audit that has been conducted. It involved reviewing everything from the 

voter history for the election, to retallying all 2.1 million ballots by hand, to performing forensic photography and review 
of the ballot paper, to conducting cyber forensic imaging and analysis of the provided voting equipment. This extensive 

process involved over 1,500 people who contributed a total of over 100,000 hours of time over the course of more than 

five months from when setup began, to when this report is completed. 


This volume of the report serves to outline details of the results from the audit; including all the data and evidence to 
support the conclusions of this report. 


4 TALLY RESULTS 





The audit included a full hand-recount of all 2.1 million ballots from the 2020 General Election. During this process all 
original ballots were counted, as well as those ballots returned from duplication. Ballots that were duplicated included 
various categories of ballots that were not able to be run through the voting machines, such as damaged ballots or 
Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) ballots. The tallies from the original ballots sent to 
duplication, and the ballots received back from duplication were kept separate so that a comparison could occur. As can 
be found in audit finding, “More Duplicates Than Originals,” there were more duplicates than there were originals. For 
this reason, we utilized the counts of the originals for all official tallies. 


This is the most important finding in the audit because the paper ballots are the best evidence of voter intent, and there 
is no reliable evidence that the paper ballots were altered to any material degree. 


4.1 Presidential Race 

The chart below summarizes the results of the hand-recount of the Presidential Race of the Maricopa County Forensic 
Audit. These tallies are based on the tallies from all original ballots and does not include the ballots duplicated from the 
originals. 

















Trump Biden Jorgenson | Write In / Over / Under Total 
Maricopa County Forensic Audit | 995,404 | 1,040,873 31,501 20,791 2,088,569 
Official Maricopa County Canvass | 995,665 | 1,040,774 31,705 21,419 2,089,563 
DELTA (261) 99 (204) (628) (994) 
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4.3 Senate Race 





The chart below summarizes the results of the hand-recount of the Senate Race of the Maricopa County Forensic Audit. 
These tallies are based on the tallies from all original ballots and does not include the ballots duplicated from the 
originals. 


NOTE: Vote totals for the presidential and senatorial elections mismatch slightly primarily due to small differences in 
hand counts among the 2.1M million ballots. 

















McSally Kelly Write In / Over / Under Total 
Maricopa County Forensic Audit | 983,662 | 1,064,336 40,398 2,088,396 
Official Maricopa County Canvass | 984,203 | 1,064,396 40,964 2,089,563 
DELTA (541) (60) (566) (1,167) 














5 VOTER History, BALLOT, AND CERTIFIED RESULTS FINDINGS 





The following section outlines all findings related to voting history, ballots and the certified results. This section covers 
everything that directly impacts the counting and accounting of results. 


5.1 Ballot Scoring Methodology 


Ballot related findings are scored based on the total number of potential ballots Ballots Impacted Severity 
impacted by the finding. Based on the range by which this falls within a Severity Critical 
is assigned, as can be seen in the chart to the right. In these circumstances a 
severity will still be assigned to the finding based on the potential impact the 
finding may have had on the election. 
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5.2 Finding Summary Table 

























































































Ballots 
# Finding Name Phase ieeered Severity 
Mail-in Ballots Voted from Prior Address Voter History 23,344 Critical 
More Ballots Returned by Voter Than Received Voter History 9,041 High 
Voters That Potentially Voted in Multiple Counties ied Results 5,295 High 
Official Results Does Not Match Who Voted Certified Results 3,432 Medium 
More Duplicates Than Original Ballots Ballot 2,592 Medium 
In-Person Voters Who Had Moved out of Maricopa County | Certified Results 2,382 Medium 
Voters Moved Out-of-State During 29-Day Period Preceding R - 
5.5.4 7 Voter History 2,081 Medium 
Election 
S55) Votes Counted in Excess of Voters Who Voted Certified results 1,551 Medium 
5.6.1 Voters Not Part of the Official Precinct Register Voter History 618 Low 
5.6.2 Duplicated Ballots Incorrect & Missing Serial Numbers Certified Results 500 Low 
5.6.3 Ballots Returned Not in the Final Voted File Ballot 430 Low 
5.6.4 Mail-in Ballot Received Without Record of Being Sent Certified Results 397 Low 
5.6.5 Voters With Incomplete Names Voter History 393 Low 
5.6.6 Deceased Voters Voter History 282 Low 
5.6.7 Audit UOCAVA Count Does Not Match the EAC Count Ballots 226 Low 
5.6.8 Late Registered Voters with Counted Votes Voter History 198 Low 
5.6.9 Date of Registration Changes to Earlier Date Voter History 194 Low 
5.6.10 Duplicate Voter IDs Voter History 186 Low 
5.6.11 Mulitple Voters Linked by AFFSEQ Voter History 101 Low 
5.6.12 Double Scanned & Counted ballots Ballot 50 Low 
5.6.13 UOCAVA Electronic Ballots Double Counted Ballot 6 Low 
5.6.14 Duplicate Ballots Reuse Serial Numbers Ballot 6 Low 
5.7.1 Audit Interference Ballot N/A Informational 
5.7.2 Batch Discrepancies Ballot N/A Informational 
5.7.3 Commingled Damaged and Original Ballots Ballot N/A Informational 
5.7.4 Early Votes Not Accounted for in EV33 Certified Results N/A Informational 
5.7.5 High Bleed-Through Rates on Ballots Ballot N/A Informational 
5.7.6 Improper Paper Utilized Ballot N/A Informational 
Se Inaccurate Identification of UOCAVA Ballots Ballot N/A Informational 
5.7.8 Missing Subpoena Items Ballot N/A Informational 
5.7.9 No Record of Voters in Commercial Database Voter History N/A Informational 
5.7.10 Out of Calibration Ballot Printers Ballot N/A Informational 
5.7.22 Real-Time Provisional Ballots Voter History N/A Informational 
5.7.42 Voter Registration System Audit Access Voter History N/A Informational 
5.7.13 Questionable Ballots Ballot N/A Informational 
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5.3 Critical Findings 





Ballots 
5.3.1MAIL-IN BALLOTS VOTED FROM PRIOR ADDRESS Impacted any 
Mail-in ballots were cast under voter registration IDs for people that may not have received their ballots by mail because 
they had moved, and no one with the same last name remained at the address. Through extensive data analysis we have 

discovered approximately 23,344 votes that may have met this condition. If a registered voter does not have a 
secondary mailing address listed with the county and no longer lives at the address listed on their voter registration, 
they should not receive their mail-in ballot by automatic postal forwarding. In certain circumstances, however, it may be 
possible for them to receive a ballot, for example, if they know the present occupant, or if the ballot is improperly 
forwarded. 


If ballots are being sent by forwardable mail, this would violate the Arizona Elections Procedures Manual, which 
requires, “A ballot-by-mail must be mailed to voters by first-class, non-forwardable mail.” EPM p. 56. Therefore, this is a 
potentially criminal act. See ARS 16-452(C) (any person who violates a rule set forth in the EPM “is guilty of a class 2 
misdemeanor.”). 


Ensuring that ballots are sent by non-forwardable mail serves an important purpose. When non-forwardable mail is 
returned undelivered, the County Recorder is required to initiate a process that places a voter on inactive status - 
meaning they will no longer automatically receive an early ballot - and may eventually remove them from the rolls 
entirely. ARS 16-165(A)(7), 544(E). 


The Final Voted File, or VMS55, was cross-checked against a commercially available data source provided by Melissa” 
called Personator. Personator is a best-in-class identity and address validation tool. It confirms that an individual is 
associated with an address, indicates prior and current addresses, tracks when and where the individual moves, tracks 
date-of-birth and date-of-death. To accomplish this, it utilized both private and government data sources such as the US 
Postal Service’s National Change of Address (NCOA) service, and the Social Security Administration’s Master Death List. 


Addresses were not included in the results if there was a valid secondary mailing address as part of the voting record. 
Only moves prior to October 5, 2020, are included in the move numbers. 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to gain access to the mail-in ballot. 




















Party % 
Democrat Party 39.5% 
Republican Party 33.0% | 
Prefer Not to Declare 26.5% | 
Libertarian Party 1.0% | 





NOTE: While high quality commercial database sources were utilized to assemble these findings, some error is expected 
within these results. To further validate these findings, it is recommended that canvassing be conducted. 


1 With the passage of SB 1485, going forward, voters may be removed from the rolls if they have not voted for a prolonged period of 
time. 


? https://www.melissa.com 
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NOTE: A full list of the Voter IDs affected can be found in esB1-B3 There are potential ways that a voter could receive 
their ballot which in some cases would not violate the law. Additional investigation by the Attorney General is 
recommended for any conclusive determination. 














Description Ballots 
Mail-in votes from voters who moved within Maricopa County prior 15,035 
to the registration deadline 
Mail-in votes from voters who moved out of Arizona prior to 6,591 
| registration deadline | 
Mail-in votes from voters who moved within Arizona but out of 1,718 
| Maricopa prior to registration deadline | 








NOTE: Please see Appendixes B1, B2 and B3 for the details for this finding. 


5.3.1.2 REFERENCES 
° ARS. § 16-101 ~ Qualifications of registrant* 
© State of Arizona ~ 2019 Elections Procedures Manual* 
¢ ARS. § 16-165 — Causes for Cancellation® 
© ARS § 16-452 ~Rules® 
© ARS § 16-544 — Permanent early voting list” 


5.3:1.2 DATA FILes UTILIZED 


Maricopa County-VM55 Final Voted Nov2020 PBRQ 43070bc7afdf40a37cd45092e9733654 


5.3.63 RECOMMENDATION 


Legislation should be considered that links voter roll registration to changes in driver’s licenses or other state 
identification, as well as requiring the current voter rolls be validated against the United States Postal Service (USPS) 
National Change of Address (NCOA) at a predefined period prior to every election. 


Laws already exist for interstate reporting of changes in residence, addresses, and driver's licenses. Tying voter roll 
registration to these forms of identification would greatly increase the likelihood that voter registration details would be 
kept up to date. Individuals are more likely to remember their license needs to be updated immediately than voter 
registration, and since all states now offer the ability to register to vote when getting a license, license updates could 
also update voter rolls. 


5 https://www.azleg.gov/ars/16/00101.htm 
“ https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL _APPROVED.pdf 
5 https://www.azleg.gov/ars/16/00165.htm 
© https://www.azleg.gov/ars/16/00452.htm 
7 https://www.azleg.gov/ars/16/00544.htm 
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It is recommended that the voter rolls be validated against the NCOA both 90 days or more prior to the election, in 
addition to a week before mail-in ballots are sent out. This check would be utilized to determine if a mail-in ballot would 
be sent to the address since ballots are not allowed to be forwarded. The legislature may want to consider whether a 
change of address should suspend Permanent Early Voting List (PEVL) enrollment. 


The Senate should consider referring this matter to the Attorney General's Office for a criminal investigation as to 
whether the requirements of ARS 16-452(C) have been violated. 


5.4 High 





Ballots 


5.4.1 More BALLOTS RETURNED BY VOTER THAN RECEIVED Impacted 9,041 


9,041 more ballots show as returned in the EV33 Early Voting Returns File for a single individual who voted by mail than 
show as sent to that individual within the EV32 Early Voting Sent File. In most of these instances an individual was sent 
one ballot but had two ballots received on different dates. 


Further investigation would be needed to determine the cause, but this could be explained in any of the possible ways: 

e¢ More than one ballot could have been sent out, but an entry was missed within the EV32 file. 

The same ballot could have been processed more than once on different days, resulting in two EV33s for one 
ballot. 

Checking into Early Vote in person may not have recognized that a mail-in ballot was already received and both 
the Early Vote In-Person and the mail-in may have generated an EV33. 

e Acounterfeit ballot was sent via mail and both the legitimate ballot sent and the counterfeit ballot generated 
EV33 entries. 


NOTE: We’ve been informed shortly before the release of this report that some of the discrepancies outlined could be 
due to the protected voter list. This has not been able to be validated at this time, but we thought it was important to 
disclose this information for accuracy. 


NOTE: An EV33 indicates that a ballot is received and does not necessarily mean the ballot was counted. It is assumed 
that only the first ballot received and validated is counted. 





Ballots Sent | Ballots Received | Quantity of 
to Voter for Voter Voters 














NOTE: Please see Appendix C1 for details on the voters who had more ballots received than sent. 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another party that was somehow able to cast a vote. 























Party % 
Democrat Party 34.4% 
Republican Party 30.4% 
Prefer Not to Declare 30.1% 
Independent 3.7% 
Libertarian Party 1.3% 








5.4.1.1 REFERENCES 
© ARS. § 16-246 — Early Balloting® 


e AJR.S. § 16-542 — Request for ballot? 
e A,R.S § 16-544 — Permanent early voting list” 
° ARS. § 16-558.01 — Mailing of Ballots’ 


5.4.1.2 DATA FILES UTILIZED 


File Name 


EV33-1377-10-09-2020_101111.txt 
EV33-1377-10-12-2020_113210.txt 
EV33-1377-10-13-2020_111553.txt 
EV33-1377-10-14-2020_112757.txt 
EV33-1377-10-15-2020_121331.txt 
EV33-1377-10-16-2020_113522.txt 
EV33-1377-10-19-2020_111708.txt 


Maricopa County-VMS55 Final Voted Nov2020 PBRQ. 


MDS Hash 
43070bc7afdf40a37cd45092e9733654 
f1daa7089f7300237f6b4ff779661cf9 
72e4e6c102e3539b4dd15b4454357b69 
9b14841281c031533322b50aabb86a24 
1b7537d7d9b927dbf4e462ed5ee8f97c 
dec7d08dde4970c26e32b8c844f4a9ab 
£0a632c3fd9b5f177d48504dc119be31 
db80b692a9188add0844a8974e227287 





EV33-1377-10-20-2020_112351.txt 


57d1795db8be71d516e29350e347fb3a 





EV33-1377-10-21-2020_111843.txt 


56c3b5a11651c68735164c578eade4e1 





EV33-1377-10-22-2020_111714.txt 


03551f170bf758efc90c013d0fe2e467 





EV33-1377-10-23-2020_112614.txt 


dbfdd369ac148723540c83f614cca454 





EV33-1377-10-26-2020_111318.txt 


Ob68adff779f59c70a530000bf989aca 





EV33-1377-10-27-2020_111413.txt 


a6fc7377bf6c6fe6653f539c5970a6F7 





EV33-1377-10-28-2020_111331.txt 


43758b9290f90d0305d5ed84aal0becb 





EV33-1377-10-29-2020_111300.txt 


410b30b06f2ca73022f27173fe114038 





EV33-1377-10-30-2020_111804.txt 


Scb44e5ea214f40227e04345d4355ff7 








EV33-1377-11-02-2020_111214.txt 


5d15bb8686a022f53400550cfe010a07 





® https://www.azleg.gov/ars/16/00246.htm 
° https://www.azleg.gov/ars/16/00542.htm 


2° https://www.azleg.gov/ars/16/00544.htm 








© https://www.azleg.gov/ars/16/00558-01.htm 
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File Name 


MD5 Hash 





EV32-1377-09-18-2020_075112.txt 


ab22e9ba4ad54af1b7a47f8381d506c7 





EV32-1377-09-30-2020_111728.txt 


2e4df9ccf2e5e64fd7e164628ff7667a 





EV32-1377-10-01-2020_113125.txt 


92538fe838c7c872957d155a98290874 





EV32-1377-10-02-2020_125658.txt 


be7d44838daa2aa758a0adb1dfe88acd 





EV32-1377-10-05-2020_112338.txt 


31a356a1a1826639759fc66afb812498 





EV32-1377-10-06-2020_114600.txt 


cb70c4468ebd51142003e46e3e1257c4 





EV32-1377-10-07-2020_111951.txt 


185d423606927ba15f827e19329c02aa 





EV32-1377-10-08-2020_111639.txt 


4f82598b6fab071300e92b8f56407451 





EV32-1377-10-09-2020_112718.txt 


bdf22cce7ecaSeebObS2dbb9f87a54b6 





EV32-1377-10-12-2020_113153.txt 


67a7ab52ab0850127528b18667eaf5c6 





EV32-1377-10-13-2020_111535.txt 


81af1c0b010368d0e11cc68e8a21f2e6 





EV32-1377-10-14-2020_112738.txt 


e88cce6a8a27b5bf755765f516710c48 





EV32-1377-10-15-2020_121305.txt 


2f12b801d981afcOe4e114bdfbf4241c 





EV32-1377-10-16-2020_113410.txt 


46a251f88fdd1d2e2352acldc61fffad 





Maricopa_EV32-1377-10-19-2020_111633-2020-10-20T14 53 30Z.txt | 9cd6e80c07e1f33129cf98302930abb6 
Maricopa_EV32-1377-10-20-2020_112309-2020-10-21T15 13 12Z.txt | e3cc25b520b5710090f4dfff2d7fce7f 
Maricopa_EV32-1377-10-21-2020_111759-2020-10-22T15 08 542Z.txt | e786fec02788d0b7c4392ca5bicd284e 
Maricopa_EV32-1377-10-22-2020_111639-2020-10-23T15 03 40Z.txt | 86ea315f6bce7c0c902027b5373f6e2c 
Maricopa_EV32-1377-10-23-2020_112532-2020-10-26T15 00 59Z.txt | ca42553da16ea38cf2b72f29b81a990F 











5.4.1.3 RECOMMENDATION 


It is recommended that the Attorney General inquire of Maricopa County as to the reason for this discrepancy, and if a 
sufficient explanation is not received an investigation be opened to investigate this further. 


Ballots 


5.4.2. VOTERS THAT POTENTIALLY VOTED IN MULTIPLE COUNTIES Impacted Bia02 


Comparing the Maricopa County VMSS5 Final Voted File to the equivalent files of the other fourteen Arizona counties 
resulted in 5,047 voters with the same first, middle, last name and birth year, representing 10,342 votes among all the 
counties. While it is possible for multiple individuals to share all these details, it is not common although the incidence 
here (roughly one-third of one percent) may be the rate of commonalities in identifying information between legitimate, 
separate individual voters especially with common last names. This list should be fully reviewed. 


NOTE: The Ballot Impacted was calculated by the total number of votes (10,342) and subtracting the number of 
maximum number of potential unique people (5,047). This yielded 5,295. 


NOTE: Please see Appendix D1 for details on the potential voters who cast a vote in more than one location. 
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5.4.2.1 


© State of Arizona ~ 2019 Elections Procedures Manual”* 
e ARS. § 16-120 - Eligibility to vote’ 


REFERENCES 








5.4.2.2 


File Name 


DATA FILES UTILIZED 


MD5 Hash 





Maricopa County-VM55 Final Voted Nov2020 PBRQ. 


43070bc7afdf40a37cd45092e9733654 





Apache County - 01_02_2021 Party CD-2021-02-09T00 22 11Z.csv 


be4cOaf2563848085d58ba6b35a486d9 





Cochise County Voter File 01022021.csv 


6839d6c54e5da7b5440018b23c239a80 





Coconino County - 11-3-20 General Voter List with Voting History.csv 


aa92299b3af0188e0d477d30929ff2e8 





Gila County - votinghistoryexport_637454437931504987.csv 


ea8475adc98ba6d488c1cf772333c750 





Graham County - votinghistoryexport022021.csv 


a967c66261fc118b12a7673cfc140293 





Greenlee Party Report Active voters with voting history 1-6-2021-2021-01- 
O6T17 47 472Z.csv 


9f911e1249c0c6303d393e88f435057c 





La Paz County - votinghistoryexport11032020-2020-12-09T19 37 25Z.csv 


a94f953df2f4843ee1a753f2102ef589 





Mojave County - Party File 1-2-2021.csv 

Navajo County - Parties List January 21-2021-02-10T22 08 472Z.csv 
Pima County - ActiveVoters20210105112009.csv 

Pinal County - Active Voter List 01052021.csv 

Santa Cruz County - 1ST QTR ACTIVE VOTER LIST REPORT 01202021.csv 
YavapaiCounty - 11-10-2020 votinghistory-Yavapai.csv 











5.4.2.3 RECOMMENDATION 








Yuma County - Voting History Export_Include ALL Registered Voters.csv d87c732fc069e85db4a92974bd7c689b 


427dfa3347df1c9a373d1c60250d71d3 
laea8fc97eaad284ba27de8689774315 
93bbfb0S586d83cc714b8d02b2ad8d8e3 
44d10afdac81cfldea2bd5faffda50dc 
73e8599aab7c084c94605621f0c148e2 
2e68ec2f922a0eda6999F3fc5b1c0638 





Legislation should be considered which requires a more clear schedule for cleaning up and maintaining voter rolls, 


including specific requirements for a county based on its size and growth. 


5.5 Medium Findings 





2? https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 


23 https://www.azleg.gov/ars/16/00120.htm 
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Ballots 


5.5.1 OFFICIAL RESULTS Do NoT MATCH WHO VOTED Impacted 3,432 


The official result totals do not match the equivalent totals from the Final Voted File (VM55). These discrepancies are 
significant with a total ballot delta of 11,592 between the official canvass and the VM55 file when considering both the 
counted and uncounted ballots. 


Official Results verses Final Voted File (VM55) — Counted Ballots 


























Description Type Official Results | Final Voted (VM55) Delta 
Mail In (R) N/A 1,702,981 
Early Vote | In Person (B) N/A 209,112 | | 
| Total 1,915,487 1,912,093 [3,394 | 
acicnbay | _Regular 167,878 N/A | | 
ets | Provisional 6,198 N/A | | 
| Total 174,076 (P) 174,038 | 38 | 
| Total Counted: 2,089,563 2,086,131 [3,432 | 





NOTE: Please see Appendix E1 for a full break-down by precinct of the differences between the Official Results and the 
Final Voted File (VM55). 


5.5.1.7 DATA FILes UTILIZED 


11-03-2020-1 Final Official Summary Report 321a78c74d4f442da0659014b29cb091 
NOV2020.pdf* 


Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 


5.5.1.2 RECOMMENDATION 


Legislation should be considered that would require the Official Canvass to fully reconcile with the Final Voted File. The 
number of individuals who showed up to vote should always match the number of votes cast. 





+4 https://record: icopa.gov/electionarchives/2020/11-03-2020- 
1%20Final%200fficial%20Summary%20Report%20NOV2020.pdf 
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Ballots 


5.5.2More DUPLICATES THAN ORIGINAL BALLOTS Impacted 2,592 


Maricopa County reported “In this election, Maricopa County had 27,869 duplicate ballots pertaining to the Presidential 
Electors.”*> The audit team counted 29,557 duplicate ballots. However, only 26,965 original ballots were sent to 
duplication. 














Basanti Ballots Count 
Maricopa County Forensic Audit = 26,965 
Original Ballots Sent to Duplication 
Maricopa County Forensic Audit — 29,557 
Duplicate Ballots Counted 
| Maricopa County — Reported 27,869 | 


Duplicate Ballots 





A comparison of the total number of original ballots sent to duplication vs the total number of duplicate ballots shows 
that Maricopa County counted 2,592 more duplicate ballots than original ballots sent to duplication. The audit team 
attempted to resolve the discrepancies, but those efforts were impeded by the County’s failure to properly identify 
duplicate ballot batches and failure to assign unique serial numbers to each damaged ballot sent to duplication and then 
match that number to the duplicate ballot printed to replace it. 


The County reported 1688 fewer ballots sent to duplication than identified by the audit team. The County provided 904 
fewer original ballots than they reportedly duplicated. 


These extra duplicates favored Republican candidates over Democrat candidates, and even favored the Libertarian 
candidate at a higher rate than the overall vote distribution. 










Description Damaged Sent to | Duplicate Ballots % Difference 
Duplication (DSD) (DUP) To Candidate | To Candidate 
Trump 48% 58% 
Biden 1,040,873 1,041,733 50% 33% 
Jorgenson | 31,501 31,580 | 2% | 3% 








Damaged Sent to | Duplicate Ballots Expected% | % Difference 














Dea ian Duplication (DSD) (pup) To Candidate | To Candidate 
McSally 983,662 985,100 47% 55% 
Kelly [1,064,336 1,065,266 | 51% | 36% 








NOTE: Please see Appendixes F1 and F2 for the details of this finding. 


* https://ecf. courts. gov 
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5.5.2.1 REFERENCES 


¢ Maricopa Clerk of Court Duplicate Ballots’® 
© — State of Arizona — 2019 Elections Procedures Manual”” 
e ARS. § 16-621 — Proceedings at the counting center™® 





§.5.2:2 RECOMMENDATION 


Legislation should be considered that requires regular audits of elections within a year of the election. Among the 
mandatory items required to perform in the audit should be a review of the duplicate ballot process. 


Ballots 


5.5.3IN-PERSON VOTERS WHO HAD MoveD Out oF Maricopa COUNTY Impacted 2,382 


The VM55 Final Voted File, was cross-checked against a commercially available data source provided by Melissa called 
Personator and 2,382 ballots were cast voter IDs for individuals that moved outside of Maricopa County prior to 
10/5/2020. Personator is a best-in-class identity and address validation tool. It confirms that an individual is associated 
with an address, indicates prior and current addresses, tracks when and where the individual moves, tracks date-of-birth 
and date-of-death. To accomplish this, it utilized both private and government data sources such as the US Postal 
Service’s National Change of Address (NCOA) service, and the Social Security Administration’s Master Death List. Only 
moves prior to October 5, 2020, are included in the move numbers. 


NOTE: While high quality commercial database sources were utilized to assemble these findings, a small percentage of 
error is expected within these results. To further validate these findings, it is recommended that canvassing be 
conducted. 


[Description allots 


In-Person votes from voters who moved out of Arizona prior 1,528 
to registration deadline 





In-Person votes from voters who moved within Arizona but 
out of Maricopa prior to registration deadline 
NOTE: Please see Appendixes G1 and G2 for additional details on the individuals that show as moved. 
NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 


represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another party that was somehow able to cast a vote. 


























Party % 
Republican Party 43.37% 
Democrat Party 25.06% | 
Prefer Not to Declare 26.87% | 
Independent 3.27% | 
Libertarian Party 1.18% | 
Green Party 0.25% | 





26 https://www.clerkofcourt.maricopa.gov/home/showpublisheddocument/1902/637425888214000000 
17 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
28 https://www.azleg.gov/ars/16/00621.htm 
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5.5.3.1 REFERENCES 
© Maricopa County ~ 11-03-2020 - General Election Canvass Summary”® 


5353332 DATA FILES UTILIZED 














File Name MD5 Hash 
Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 
5.5.3.3 RECOMMENDATION 


Legislation should be considered that links voter roll registration to changes in driver’s licenses or other state 
identification, as well as requiring the current voter rolls be validated against the United States Postal Service (USPS) 
National Change of Address (NCOA) at a predefined period prior to every election. 


Laws already exist for interstate reporting of changes in residence, addresses, and driver's licenses. Tying voter roll 
registration to these forms of identification would greatly increase the likelihood that voter registration details would be 
kept up to date. Individuals are more likely to remember their license needs to be updated immediately than voter 
registration, and since most states now offer the ability to register to vote when getting a license, license updates could 
also update voter rolls. 


It is recommended that the voter rolls be validated against the NCOA both 90 days or more prior to the election, in 
addition to a week before mail-in ballots are sent out. This check would be utilized to determine if a mail-in ballot would 
be sent to the address since ballots are not allowed to be forwarded. The legislature may want to consider whether a 
change of address should suspend Permanent Early Voting List (PEVL) enrollment. 


38 https://recorder.maricopa.gov/electionarchives/2020/11-03-2020- 
1%20Final%200fficial%20Summary%20Report%20NOV2020.pdf 
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Ballots 
5.5.4VOTERS MOVED OuT-OF-STATE DURING 29-Day PERIOD PRECEDING ELECTION Impacted 7°84 


Arizona law and the 2019 Election Procedures Manual address the specific voting eligibility of a person who moves out 
of Arizona during the 29-day period before the election. A person that moved out of Arizona between 10/5/2020 and 
11/03/2020, was no longer legally considered a “resident,” however was eligible by law to vote a presidential-only 
ballot. See the image below taken from the 2019 Elections Procedure Manual (pg. 30). 


ARIZONA SECRETARY OF STATE 
2019 ELECTIONS PROCEDURES MANUAL 


Ifa registrant moves to a different state during the 29-day period preceding the next election, the 


registrant is not a qualified elector (and is therefore ineligible to vote) in Arizona. However, a 
registrant retains the right to vote in Arizona for President of the United States (and no other races) 
at the general election during a Presidential election year. ARS. § 16-126, Requesting a 
presidential-only ballot requires the County Recorder to cancel the registrant’s record “promptly” 
following the general election. A.R.S. § 16-165(A)(6). 





The 2019 Elections Procedure Manual states “A registrant is a “resident” if they have physical presence in the county 
along with an intent to remain. A registrant may be temporarily absent from the jurisdiction without losing their 
residency status, as long as they have an intent to return. A.R.S. § 16-103.” (pg. 12) 


The Final Voted File, or VM55, was cross-checked against a commercially available data source provided by Melissa” 
called Personator. Personator is a best-in-class identity and address validation tool. It confirms that an individual is 
associated with an address, indicates prior and current addresses, tracks when and where the individual moves, tracks 
date-of-birth and date-of-death. To accomplish this, it utilized both private and government data sources such as the US 
Postal Service’s National Change of Address (NCOA) service, and the Social Security Administration’s Master Death List. 


The cross-check resulted in 2,081 instances of a voter that moved out of the state of Arizona during the 29-day period 
before the election who cast a ballot in the 2020 general election. It cannot be determined whether these voters 
undervoters all the races on their ballots other than the presidential race, thereby creating a de facto Presidential-Only 
ballot. 


The ballot definitions on the Dominion EMS do not include a “Presidential-Only” ballot. The Dominion voting machines 
would not be able to read a ballot for which a ballot definition does not exist. Additionally, in examining the EV33 sent 
ballot files for ballot codes, the ballot images, and the cast vote record, no presidential-only ballots as specified by A.R.S. 
§ 16-126 and the 2019 Election Procedures Manual were found to be cast in this election. 


?° https://www.melissa.com 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 


























Party % 
Republican Party 41.28% 
Democrat Party 31.57% 
Prefer Not to Declare 21.96% 
Independent 4.32% 
Libertarian Party 0.82% 
Green Party 0.05% 








NOTE: Please see Appendix H1 for details on the voters who moved out-of-state during the 29-day period preceding the 
election. 


5.5.4.1 REFERENCES 
¢ Arizona State - 2019 Elections Procedure Manual” 


¢ ARS. § 16-126 — Authority to vote in a presidential election after moving from state” 
© ARS. § 16-103 ~ Qualified person temporarily absent from the state** 


5.5.4.2 Data Fites UTILIZED 


Maricopa County-VMS55 Final Voted Nov2020 PBRQ 43070bc7afdf40a37cd45092e9733654 


5.5.4.3 RECOMMENDATION 

Legislation should be considered that links voter roll registration to changes in driver’s licenses or other state 
identification, as well as requiring the current voter rolls be validated against the United States Postal Service (USPS) 
National Change of Address (NCOA) at a predefined period prior to every election. 


Laws already exist for interstate reporting of changes in residence, addresses, and driver's licenses. Tying voter roll 
registration to these forms of identification would greatly increase the likelihood that voter registration details would be 
kept up to date. Individuals are more likely to remember their license needs to be updated immediately than voter 
registration, and since most states now offer the ability to register to vote when getting a license, license updates could 
also update voter rolls. 


It is recommended that the voter rolls be validated against the NCOA both 90 days or more prior to the election, in 
addition to a week before mail-in ballots are sent out. This check would be utilized to determine if a mail-in ballot would 
be sent to the address since ballots are not allowed to be forwarded. The legislature may want to consider whether a 
change of address should suspend Permanent Early Voting List (PEVL) enrollment. 


21 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
22 https://www.azleg.gov/ars/16/00126.htm 


23 https://www.azleg.gov/ars/16/00103.htm 
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Ballots 
5.5.5 VOTES COUNTED IN EXCESS OF VOTERS WHO VOTED Impacted apet 


The number of votes cast in an election should not exceed the number of voters who participate in the election. An 
analysis of the Maricopa County Official Canvass and the VM55 Final Voted file from November 2020 show that multiple 
precincts counted votes in excess of the number of voters who participated in the 2020 General Election. 


Reconciliation of the voters who participated to ballots cast is first required at a every vote center for election day 
voting. The County Audit Board is required to reconcile the voters who participated with the ballots cast for each 
precinct prior to certifying the Official Canvass. The expected delta should be more voters who voted than votes cast 
because some ballots were undervoted or overvoted. There were 277 precincts with a voter deficit, 65 precincts with an 
equal number of voters who voted, and cards cast. There were 401 precincts with the expected surplus. 


NOTE: We’ve been informed shortly before the release of this report that some of the discrepancies outlined could be 
due to the protected voter list. This has not been able to be validated at this time, but we thought it was important to 
disclose this information for accuracy. 
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NOTE: The following chart illustrates the percentage of voters by registered party that are given within the precincts that 
the Ballot Impacted number represents. Understanding why there is more votes than voters in this precinct would be 
required before any determination could be made as to whether the precinct breakouts would influence how this 
finding impacted the votes. 























Party % 
Republican Party 42.25% 
Democrat Party 30.02% | 
Prefer Not to Declare 22.34% | 
Independent 4.41% | 
Libertarian Party 0.90% | 
Green Party 0.0% | 











From the Arizona Election Procedure Manual, the Audit Board has several responsil 


“1. Receives the Official Ballot Reports for each voting location and any supplemental information from the election 
boards that could explain any discrepancies. 


2. Receives the signature rosters, poll lists (or scanned copies), or reports from e-pollbooks that show voter check-ins and 
signatures...” 


“9. Identifies discrepancies in the reports following final tabulation of duplicated ballots and provisional ballots. 
10. Resolves problems that appear to be of major significance in the presence of political party observers; and 


11. Resolves and documents all discrepancies. The functions of the Audit Board must be completed prior to the 
acceptance of the canvassing.” 


Note that the Audit Board must consider discrepancies after the final tabulation which would include discrepancies in 
the number of votes counted vs. the number of voters who participated in the election. This would include mail ballots, 
duplicated ballots and provisional ballots for voters in every precinct. Maricopa County failed to resolve these 
discrepancies prior to acceptance of the canvass. 


NOTE: Please see Appendix |1 for the full list broken out by precinct. 


5.5.5.1 REFERENCES 


© State of Arizona — 2019 Elections Procedures Manual”™* 





5.5.5.2 DATA FILES UTILIZED 

















File Name MDS5 Hash 
11-03-2020-2b Final SOV and Official Canvass Report NOV2020.csv e907163ef4b0d99e116c24fcb98a6969 
Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 





24 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
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6.5.5.3RECOMMENDATION 


Maricopa County Election Officials and Audit Board should examine all records and resolve all discrepancies prior to 
certification of election results. Each legal voter should be permitted to vote one and only one time. 


5.6 Low Findings 





Ballots 


5.6.1 VoTeRS NoT PART OF THE OFFICIAL PRECINCT REGISTER Impacted os 


The list of individuals who are eligible and able to vote in an election, also known as the official precinct register, is 
established 10 days prior to the election. This means that for the 2020 General Election this was established on October 
22", At that point in time everyone who was officially on the voter rolls for the election should have been on the rolls. It 
should not require an earlier or a later voter roll file to find a complete list of everyone who was eligible and actually 
voted in the election. However, a review of the VMS55 Final Voted File for the 2020 General Election shows voter IDs that 
do not show on either the October 2, 2020 voter rolls or on the November 7, 2020 voter rolls. To match up all the voter 
IDs that show on the VM55 Final Voted File for the 2020 General Election it requires that you look back to the April 9, 
2017, voter rolls to find all the IDs: in addition to also requiring the December 4, 2020, rolls. In total it takes 12 different 
months VM34 Monthly Voter Roll files to find and match-up all voters in the 2020 General Election. This can be seen in 
the diagram below. 













Voters 









12/4/2020 
11/7/2020 
9/5/2020 
8/8/2020 
7/3/2020 
6/6/2020 
12/6/2019 
10/5/2019 
4/5/2019 
2/2/2019 
5/6/2017 
4/9/2017 


2, = 465 





























NOTE: It is expected that the official precinct registration might be missing a few people who hadn’t provided proof of 
citizenship prior, and has until 7pm on election day to provide this information; or those who qualify for UOCAVA who 
are allowed to register to vote up until 7pm on election day. However, in both cases you would expect these individuals 
to be in the November 7" rolls, which occurs after the election. 


NOTE: Please see Appendix A for a copy of the VM55 Final Voted File joined to the appropriate rows of data from all of 
the above VM34s. This file is utilized as the basis for every finding that requires both VM55 and VM34 data. 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 























Party % 
Republican Party 37.06% 
Democrat Party 34.79% 
Prefer Not to Declare 26.54% 
Libertarian Party 1.13% 
Independent 0.49% 








5.6.1.1 REFERENCES 
e ARS. § 16-168 - Precinct registers” 


5.6.1.2 DATA FILes UTILIZED 


Maricopa County-VM55 Final Voted Nov2020 PBRQ 43070bc7afdf40a37cd45092e9733654 
Maricopa County-VM34 Voter Registration Oct 2, 2020 99a4440ae9bab7f0de96d7656b4e739d 


Maricopa County-VM34 Voter Registration Nov 7, 2020 d7bfc018296832836d2bd8de440cba53 
Maricopa County-VM34 Voter Registration Dec 4, 2020 255f69007b253c7f2737b050c439f269 





5.6.1.3 RECOMMENDATION 


Legislation should be considered that will require that the precinct registers be complete and comprehensive of every 
individual who could legally vote for the election. 


25 https://www.azleg.gov/ars/16/00168.htm 
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Ballots 
5.6.2 DUPLICATED BALLOTS INCORRECT & MISSING SERIAL NUMBERS Impacted 500 


Damaged Ballots sent to duplication must have a serial number that can be matched to the duplicate (replacement 
ballot). Many damaged ballots sent to duplication do not have a serial number, and multiple duplicated ballots have 
incorrect serial numbers that do not match the original ballots. The County must “record an identical serial number on 
both the original and duplicate ballot (including spoiled duplicates) — this ties the ballots together and creates a paper 
trail as required by statute, A.R.S. § 16-621(A)” 


In addition, there are hundreds of damaged ballots with unreadable serial numbers like these examples below: 





Of those original ballots that had a readable serial number, several of them had incorrect serial numbers. In some cases, 
as shown in the example below, the audit team was able to identify the original ballot and the duplicate ballot based on 
a series of precinct, ballot type and presidential selection. The five ballots in the table below had incorrect serial 
numbers on the duplicate ballot. 


Duplicate Ballot Serial Ballot | Presidential | Original Damaged Ballot 
Number Type Selection Serial Number 

DUPBOARD3HANDO214 | 643 | 0 | Biden | Board 1Hand Dup 214 

DUPBOARD3HANDO215 te Board 1 Hand Dup 215 


DUPBOARD3HANDO216 Board 1 Hand Dup 216 
DUPBOARD3HANDO217 Board 1 Hand Dup 217 


DUPBOARD3HANDO218 eae as Board 1 Hand Dup 218 








Segment Trailer Sheet showing precinct and ballot type 
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UOCAVA Ballot Image showing precinct, ballot type 


5.6.2.1 REFERENCES 


© State of Arizona — 2019 Elections Procedures Manual’* 





© A.R.S. § 16-621 — Proceedings at the counting center’” 





5.6.2.2 RECOMMENDATION 


Legislation should be considered that requires regular audits of the duplicate ballot process. 


26 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
27 https://www.azleg.gov/ars/16/00621.htm 
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Ballots 


5.6.3 BALLOTS RETURNED NOT IN THE FINAL VOTED FILE Impacted baw 


Ballots show as returned in the EV33 Early Voting Returns File but there is no matching record in the VM55 Final Voted 
File. All entries in the EV33 file show with a ballot status of “Returned” and the only other status of “Voided Early Ballot” 
is not used anytime in the 2020 General Election. 


The most likely explanation is that these ballots represent rejected ballots. However, the number of ballots in question, 
2,472, does not match the 2,976 ballots that were rejected (2,042) or late (934). It is expected there should be a full 


accounting of all ballots received and voted that can be matched up to individual voter participation. 


NOTE: Please see Appendix K1 for a list of all the EV33 entries that cannot be found in the VM55 file. 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 





5.6.3.1 REFERENCES 


¢ ARS. 16-542 — Request for ballot” 
e ARS. 16-246 — Early Balloting”? 


28 https://www.azleg.gov/ars/16/00542.htm 


29 https://www.azleg.gov/ars/16/00246.htm 
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5.6.3.2 DATA FILES UTILIZED 





File Name 


MD5 Hash 





Maricopa County-VM55 Final Voted Nov2020 PBRQ. 


43070bc7afdf40a37cd45092e9733654 





EV33-1377-10-09-2020_101111.txt 


f1daa7089f7300237f6b4ff779661cf9 





EV33-1377-10-12-2020_113210.txt 


72e4e6c102e3539b4dd15b4454357b69 





EV33-1377-10-13-2020_111553.txt 


9b14841281c031533322b50aabb86a24 





EV33-1377-10-14-2020_112757.txt 


1b7537d7d9b927dbf4e462ed5ee8f97c 





EV33-1377-10-15-2020_121331.txt 


dec7d08dde4970c26e32b8c844f4a9ab 





EV33-1377-10-16-2020_113522.txt 


£0a632c3fd9b5f177d48504dc119be31 





EV33-1377-10-19-2020_111708.txt 


db80b692a9188add0844a8974e227287 





EV33-1377-10-20-2020_112351.txt 


57d1795db8be71d516e29350e347fb3a 





EV33-1377-10-21-2020_111843.txt 


56c3b5a11651c68735164c578eade4e1 





EV33-1377-10-22-2020_111714.txt 


03551f170bf758efc90c013d0fe2e467 





EV33-1377-10-23-2020_112614.txt 


dbfdd369ac148723540c83f614cca454 





EV33-1377-10-26-2020_111318.txt 


Ob68adff779f59c70a530000bf989aca 





EV33-1377-10-27-2020_111413.txt 
EV33-1377-10-28-2020_111331.txt 
EV33-1377-10-29-2020_111300.txt 
EV33-1377-10-30-2020_111804.txt 
EV33-1377-11-02-2020_111214.txt 























a6fc7377bf6c6fe6653f539c5970a6f7 
43758b9290f90d0305d5ed84aal0becb 
410b30b06f2ca73022f27173fe114038 
Scb44e5ea214f40227e04345d4355ff7 
5d15bb8686a022f53400550cfe010a07 











5.6.3.3 RECOMMENDATION 


Legislation should be considered that requires that the various election related systems to properly integrate in order to 
give accurate and consistent counts between the mail-in ballots cast, mail-in ballots received, mail-in ballots accepted, 
mail-in ballots rejected, and be able to reconcile these details with who voted in the final voted file. 


Ballots 
5.6.4MaliL-IN BALLOT RECEIVED WITHOUT RECORD OF BEING SENT Impacted _ 


Ballots show as returned in the EV33 Early Voting Returns File for a voter who voted by mail but there is no matching 
record in the EV32 Early Voting Sent File showing that a ballot was ever sent. This most likely means that there was a 
clerical error in the EV32 Early Voting Sent Files and ballots that were sent out legitimately were not recorded. 


NOTE: At an earlier hearing it was stated that there were 74,243 entries in EV33 Early Voting Returns Files without a 
corresponding entry in the EV32 Early Voting Sent Files. This was brought up in the context of justification for 
performing canvassing to further validate the reasoning for this discrepancy. While this discrepancy is accurate, it was 
unintentionally misleading. All but 397 of those entries were Early Voting in-person votes which also generate an EV33 
entry in addition to mail-in ballots. 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 


























Party % 
Democrat Party 33.25% 
Republican Party 31.49% 
Prefer Not to Declare 29.72% 
Independent 3.53% 
Libertarian Party 2.02% 
Green Party 0.08% 








NOTE: Please see Appendix L1 for a complete list of the voters who had a ballot received, but there is no record of a 


ballot being sent. 


5.6.4.1 REFERENCES 


¢ A,R.S. 16-542 — Request for ballot*° 





° ARS. 16-246 ~ Early Balloting** 


5.6.4.2 DATA FILES UTILIZED 
File Name 


EV33-1377-10-09-2020_101111.txt 
EV33-1377-10-12-2020_113210.txt 
EV33-1377-10-13-2020_111553.txt 
EV33-1377-10-14-2020_112757.txt 
EV33-1377-10-15-2020_121331.txt 
EV33-1377-10-16-2020_113522.txt 
EV33-1377-10-19-2020_111708.txt 
EV33-1377-10-20-2020_112351.txt 


Maricopa County-VM55 Final Voted Nov2020 PBRQ 


MD5 Hash 
43070bc7afdf40a37cd45092e9733654 
f1daa7089f7300237f6b4ff779661cf9 
72e4e6c102e3539b4dd15b4454357b69 
9b14841281c031533322b50aabb86a24 
1b7537d7d9b927dbf4e462ed5ee8f97c 
dec7d08dde4970c26e32b8c844f4a9ab 
f0a632c3fd9b5f177d48504dc119be31 
db80b692a9188add0844a8974e227287 
57d1795db8be71d516e29350e347fb3a 





EV33-1377-10-21-2020_111843.txt 


56c3b5a11651c68735164c578eadede1 





EV33-1377-10-22-2020_111714.txt 


03551f170bf758efc90c013d0fe2e467 





EV33-1377-10-23-2020_112614.txt 


dbfdd369ac148723540c83f614cca454 





EV33-1377-10-26-2020_111318.txt 


Ob68adff779f59c70a530000bf989aca 





EV33-1377-10-27-2020_111413.txt 


a6fc7377bf6c6fe6653f539c5970a6F7 





EV33-1377-10-28-2020_111331.txt 


43758b9290f90d0305d5ed84aal0becb 





EV33-1377-10-29-2020_111300.txt 


410b30b06f2ca73022f27173fe114038 





EV33-1377-10-30-2020_111804.txt 


Scb44e5ea214f40227e04345d4355ff7 





EV33-1377-11-02-2020_111214.txt 


5d15bb8686a022f53400550cfe010a07 





EV32-1377-09-18-2020_075112.txt 


ab22e9ba4ad54af1b7a47f8381d506c7 








EV32-1377-09-30-2020_111728.txt 


2e4df9ccf2e5e64fd7e164628ff7667a 





20 https://www.azleg.gov/ars/16/00168.htm 
31 https://www.azleg.gov/ars/16/00246.htm 
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File Name 


MD5 Hash 





EV32-1377-10-01-2020_113125.txt 


92538fe838c7c872957d155a98290874 





EV32-1377-10-02-2020_125658.txt 


be7d44838daa2aa758a0adbidfe88acd 





EV32-1377-10-05-2020_112338.txt 


31a356a1a1826639759fc66afb812498 





EV32-1377-10-06-2020_114600.txt 


cb70c4468ebd51142003e46e3e1257c4 





EV32-1377-10-07-2020_111951.txt 


185d423606927ba15f827e19329c02aa 





EV32-1377-10-08-2020_111639.txt 


4f82598b6fab071300e92b8f56407451 





EV32-1377-10-09-2020_112718.txt 


bdf22cce7ecaSeebOb52dbb9f87a54b6 





EV32-1377-10-12-2020_113153.txt 


67a7ab52ab0850127528b18667eaf5c6 





EV32-1377-10-13-2020_111535.txt 


81af1c0b010368d0e11cc68e8a21f2e6 





EV32-1377-10-14-2020_112738.txt 


e88cce6a8a27b5Sbf755765f516710c48 





EV32-1377-10-15-2020_121305.txt 


2f12b801d981afc0e4e114bdfbf4241¢ 





EV32-1377-10-16-2020_113410.txt 


46a251f88fdd1d2e2352acldc61fffa9 





Maricopa_EV32-1377-10-19-2020_111633-2020-10-20T14 53 30Z.txt 


9cd6e80c07e1f33129cf98302930abb6 








Maricopa_EV32-1377-10-20-2020_112309-2020-10-21T15 13 12Z.txt 


e3cc25b520b5710090f4dfff2d7fce7F 





Maricopa_EV32-1377-10-21-2020_111759-2020-10-22T15 08 54Z.txt 





e786fec02788d0b7c4392ca5bicd284e 











Maricopa_EV32-1377-10-22-2020_111639-2020-10-23T15 03 40Z.txt 
Maricopa_EV32-1377-10-23-2020_112532-2020-10-26T15 00 59Z.txt 









86ea315f6bce7c0c902027b5373f6e2c 
ca42553da16ea38cf2b72f29b81a990F 








5.6.4.3 RECOMMENDATION 


It is recommended that the Attorney General inquire of Maricopa County as to the reason for this discrepancy, and if a 
sufficient explanation is not received an investigation be opened to investigate this further. 


5.6.5 VOTERS WITH INCOMPLETE NAMES Impacted 


Ballots 
393 


A.R.S. 16-152 requires that the form used for the registration of electors shall contain the registrant’s given name, 
middle name, if any, and surname. 


The 11/07/2020 VM34 contains 720 voters with incomplete names. 393 of these voters voted in the 2020 General 
Election. 


Examples of incomplete names include: 
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Voters with only a last name 

Voters with only an initial for their last name 

Voters with an initial for their first name and last name 
Voters with no last name 

Voters with only an initial for their first name 
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NOTE: It is possible to have a legal name that is just an initial, or to not have a surname. However, this is extremely rare, 
and the list should be reviewed to determine its accuracy. 




















Description Number of voters 

Last name only 15 
| Last name is an initial only 9 | 
| No last name 45 | 
| First name is an initial only 324 | 
| Total 393 | 





The 2019 Elections Procedure Manual addresses failure to provide name. “If the State Form, Federal Form, FPCA, or 
FWAB does not contain the registrant’s name, residence address or location, DOB, or signature (or assisting person’s 
signature), but the County Recorder has the address, telephone number, or email address to contact the registrant to 
request the incomplete information, the registrant should be entered into the voter registration database in a 
“suspense” status until the incomplete information or a new voter registration form is received. A.R.S. § 16-134(B); 
A.R.S. § 16-121.01(A).” (pgs. 18-19) 


If the registrant does not provide the missing, incomplete, or illegible information by 7:00 p.m. on the date of the next 
regular general election, the registration form is invalid and the registrant’s status may be changed from “suspense” to 
“not registered,” with the reason code “pending expired” (or functional equivalent). The registrant would need to 
submit a new voter registration application to be eligible to vote in future elections. (pg. 19) 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 


[Democrat Party | 34.35% | 
Republican Party 32.57% 


Prefer Not to Declare 24.43% 
6.87% 


Libertarian Party 1.27% 








| Green Party 51% | 





NOTE: Please see Appendixes M1 and M2 for a list of voters with incomplete names who voted, and a list of all 
incomplete names on the November 7, 2020 voter rolls. 


© 2021 Cyber Ninjas FOR ARIZONA SENATE USE ONLY Page 28 of 96 


5.6.5.1 REFERENCES 


¢ ARS. 16-152 — Registration Form” 
© State of Arizona - 2019 Elections Procedure Manual*? 


DATA FILES UTILIZED 








pa County-VM55 Final Voted Nov2020 PBRQ 43070bc7afdf40a37cd45092e9733654 | 








5:6:5.3 RECOMMENDATION 


Legislation should be considered that requires the voter registration entries be a direct match with any acceptable form 
of government identification, and always checked against that identification to validate compliance. If existing laws are 
sufficient that this should be occurring, additional legislation should be considered to increase the likelihood of 
compliance such as penalties. 


Ballots 


8: 
5.6.6 DECEASED VOTERS Impacted 282 


The Final Voted File, or VM55, was cross-checked against a commercially available data source provided by Melissa®* 
called Personator, and it was found that 282 individuals who were flagged as deceased prior to October 5, 2020, voted in 
the election. 


Personator is a best-in-class identity and address validation tool. It confirms that an individual is associated with an 
address, indicates prior and current addresses, tracks when and where the individual moves, tracks date-of-birth and 
date-of-death. To accomplish this, it utilized both private and government data sources such as the US Postal Service’s 
National Change of Address (NCOA) service, and the Social Security Administration’s Master Death List. 


NOTE: It is recommended that the Attorney General further investigate this finding to confirm the validity of this finding, 
and if applicable, determine who cast the vote on behalf of the deceased individual. 


3? https://www.azleg.gov/ars/16/00152.htm 
33 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL _APPROVED.pdf 
54 https://www.melissa.com 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 























Party % 
Republican Party 49.65% 
Democrat Party 30.14% 
Prefer Not to Declare 12.77% 
Independent 7.09% 
Libertarian Party 0.35% 








NOTE: Please see Appendix N1 for a complete list of individuals who show as being dead in Melissa. 


5.6.6.1 DATA FILES UTILIZED 


Maricopa County-VM55 Final Voted Nov2020 PBRQ 43070bc7afdf40a37cd45092e9733654 


5.6.6.2 RECOMMENDATION 


Legislation should be considered to require the voter rolls to periodically be compared against the Social Security's 
Master Death List, or other commercially available tools that gives access to this information. A minimum frequency on 
to conduct this should specifically be required. 


Ballots 
5.6.7 AupIT UOCAVA Count Does Not MATCH THE EAC COUNT Impacted 


The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) requires all counties in the United States to report 
data related to the ability of civilian, military, and overseas citizens to register to vote and successfully cast a ballot. 
Analysis of the data submitted by Maricopa to the US Election Commission shows discrepancies in the number of ballots 
reported by the County to the EAC and the number of ballots observed during the audit. The audit team found 226 
more electronically submitted UOCAVA ballots than the County reported to the EAC. Any UOCAVA ballots returned by 
mail were not identified as UOCAVA. Therefore, the audit team used the County mail numbers reported to the EAC. A 
Public Records Request for UOCAVA data was submitted to the Arizona Secretary of State but as of this date, no records 
have been provided in response to that request. 


226 


Election Administration Voting Survey 2020 vs Audit Counts 





UOCAVA Type EAVS 2020 | Audit Count | Discrepancy 











Electronically 8,988 9,214 -226 
| Mail 1,420 Comingled [| Unknown | 
| Total 10,408 - | : | 
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While many people believe that UOCAVA is a law that primarily enables active-duty military men and women to vote, it 
is used more often by non-military voters. See below table of the total number of Civilian vs Military voters who were 
UOCAVA eligible in Maricopa County based on the November 07, 2020, VM34 Monthly Voter Rolls. 








Military Military % | Civilian Ballots | Civilian % of 
Returned Ballots | of UOCAVA Returned UOCAVA 
4,359 35% 7,934 65% 





The law allows military voters who are out of their home county to vote electronically. However, non-military voters 
(civilians) who are not out of the country are not eligible to vote electronically. According to Maricopa County’s 
UOCAVA Map website, more than 140 civilians —- who were not UOCAVA eligible due to being in the United States--were 
permitted to vote via UOCAVA in the 2020 General Election. 





The Uniformed and Overseas Citizens Absentee Voting Act defines eligibility as: 


e Amember of a uniformed service on active duty who, by reason of such active duty, is absent from the place of 
residence where the member is otherwise qualified to vote; 

« Amember of the merchant marines who, by reason of service in the merchant marine, is absent from the place 
of residence where the member is otherwise qualified to vote; or 

e Aspouse or dependent of a member referred to above who, by reason of the active duty or service of the 
member, is absent from the place of residence where the spouse or dependent is otherwise qualified to vote. 

e  Anabsent uniformed services voter who, by reason of active duty or service is absent from the United States on 
the date of the election involved; 

e Aperson who resides outside the United States and is qualified to vote in the last place in which the person was 
domiciled before leaving the United States; or 

e Apperson who resides outside the United States and (but for such residence) would be qualified to vote in the 
last place in which the person was domiciled before leaving the United States 


Maricopa County shows that there are 12,293 eligible UOCAVA voters based on the November 7, 2020, VM34 Monthly 
Voter Rolls. Of these UOCAVA ballots transmitted, 85% or 10,408 were reported as returned. Historically, approximately 
68% of UOCAVA voters return their ballot. 


5.6.7.1 REFERENCES 
* State of Arizona — 2019 Elections Procedures Manual 
* Maricopa County UOCAVA Map Website 
© US Election Commission 2020 Survey Results*” 
* US Election Commission 2016 Survey Results*® 


135 








35 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 


3° https://recorder.maricopa.gov/uocavamap/ 


57 https://www.eac.gov/research-and-data/studies-and-reports 
38 https://www.eac.gov/sites/default/files/eac_assets/1/6/2016 EAVS Comprehensive Report.pdf 
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5.6.7.2 DATA FILES UTILIZED 




















File Name MD5. 

11-03-2020-0 Canvass COMPLETE NOV2020 ce62cc061b6bb56b4fd40aa4866adb16 

Maricopa County-VM3é4 Voter Registration Nov 7, 2020 d7bfc018296832836d2bd8de440cba53 
5.6.7.3 RECOMMENDATION 


Legislators should consider auditing the UOCAVA voting system to determine whether any changes are required to 
ensure the integrity of the vote. 


Ballots 


5.6.8LATE REGISTERED VOTERS WITH COUNTED VOTES Impacted 198 


Individuals who registered to vote after the October 15" deadline were allowed to cast a vote and these votes were 
counted, The Final Voted File, or the VMS55, is the official record of who cast a vote for a given election. This file does not 
contain the Date of Registration for individuals who voted in the election, but it does include each person’s Voter ID 
which can be cross referenced against the Full Voter File, or VM34, to get the registration date value. 


It would be expected that either the October or the November VM34 file would contain all of the registered voters that 
voted in on the November 2020 General Election, but this was not the case. It took 12 different VM34 files ranging from 
April 9, 2017, to December 4"", 2020, to find all of the Voter IDs found in the Final Voted VM55 File for the 2020 General 
Election. 


When utilizing multiple Full Voter Files that span multiple years it can get complicated to determine which data for a 
given Voter ID should be utilized when that Voter ID is found in more than one file. For the purpose of our analysis for 
this and other findings we assumed that the November 7, 2020, VM34 file would be the most accurate since it was right 
after the election, and the only VM34 officially provided by Maricopa County as part of a subpoena. 


As a result, we loaded the data from VM34 files for every month from January 2017 through December 2020 into a 
database. First, we loaded the December 4, 2020, VM34 file. We then subsequently loaded the VM34 files from the 
oldest to the newest, with each subsequent VM34 file replacing the stored data for any Voter ID that had existed ina 
prior load and finishing with the November 7, 2020, file. This ensured that we always had the most current data for a 
given Voter ID, and the latest data from the last time a given Voter ID showed up in a VM34 file would always be utilized. 


This composite VM34 file was then matched up with the VMS55 file to provide additional details for all voters within the 
Final Voted VMSS file. 
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In all, it required data from the following VM34 files to match all the data: 





# Of Matched 
Moters 
12/4/2020 605 
11/7/2020 2,089,465 
9/5/2020 1 
8/8/2020 1 
7/3/2020 1 
6/6/2020 Ed 
12/6/2019 2 
10/5/2019 3 
2 
1 
= 
1 


VM34 File Date 
































4/5/2019 
2/2/2019 








5/6/2017 
4/9/2017 














When building this file in this manner there were 198 voters registered after October 15" who voted in the election and 
had their vote counted, according to the Final Voted File. 


NOTE: Individuals who register according to the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) were 
not included in this list as the rules for UOCAVA allow registration up to 7:00pm on election day. 


NOTE: Publicly, we had stated that there were 3,981 individuals who had registered after October 15" and voted. This 
was based on a wrong assumption by one of our data analysts who concluded that the only way the Official Canvass 
could match the Final Voted VMS5 file was if those voters flagged as “Q,” or uncounted provisional ballots, were in fact 
counted in the Official Canvass. While the discrepancy between the Official Canvass and the VM55 numbers are very 
similar to that number, assumptions should not have been made as to the reasoning for that. 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 























Party % 
Republican Party 33.84% 
Democrat Party 31.82% | 
Prefer Not to Declare 33.33% | 
Independent 0.51% | 
Libertarian Party 0.51% | 





NOTE: Please see Appendix A for the complete VM55 Final Voted File with all of the various VM34 files. 


NOTE: Please see Appendix O1 for a list of the late registered voters who voted. 
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5.6.8.1 REFERENCES 
e ARS. § 16-152 — Registration Form 
¢ ARS. § 16-120 - Eligibility to vote” 
¢ ARS. § 16-101 — Qualifications of registrant** 





5.6.8.2 DATA FILES UTILIZED 


























File Name MDS5 Hash 

Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 

Maricopa County-VM34 Voter Registration Oct 2, 2020 99a4440ae9bab7f0de96d7656b4e739d 

Maricopa County-VM3é4 Voter Registration Nov 7, 2020 d7bfc018296832836d2bd8de440cba53 

Maricopa County-VM3é4 Voter Registration Dec 4, 2020 255f69007b253c7f2737b050c439f269 
5.6.8.3 RECOMMENDATION 


Legislation should be considered that would require applications developed and utilized for voter rolls or voting to be 
developed to rigorous standards that ensure the confidentiality and integrity of the systems. This would prevent the 
entry of invalid data. Specifically, its recommended that the Open Web Application Security Project (OWASP) Application 
Security Verification Standard (ASVS) Level 3 be applied to all applications associated with voter rolls or voting and that 
it be required that this be fully validated no less than once every two years. 


Ballots 


5.6.9DATE OF REGISTRATION CHANGES TO EARLIER DATE Impacted a2 


Dates of Registration in the Full Voter File, also known as a VM34, are periodically changing, including changing to earlier 
dates, Dates of Registration are significant because they can determine if someone is eligible to vote in an election, or if 

they're not eligible. Based on communications with the Maricopa County Recorder's Office, Dates of Registration should 
never change except for fixing the occasional mistake. 


A review of the November 7, 2020, VM34 file and subsequent VM34 files for the remainder of 2020 and into 2021 show 
891 dates of registration changes that would have made someone eligible to vote in the November 2020 General 
Election when their date of registration shown on the November 7" file would have prohibited it. Out of these 890 dates 
of registration, 193 had their votes counted in the 2020 General Election despite still having an ineligible date of 
registration on the November 7" VM34. 


9 https://www.azleg.gov/ars/16/00152.htm 
*° https://www.azleg.gov/ars/16/00120.htm 


 https://www.azleg.gov/ars/16/00101.htm 
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NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 





Party 
Prefer Not to Declare 
Republican Party 
Democrat Party 
Independent 
Libertarian Party 























Subject: RE: C 1 Website Comments - Voter Information 


a 


Thank you for your questi 


Are there any circumstances in which someone's registration date can change? 


de of correcting a mistake. The date of registration is the 
in in the county, while any updates to a voter's registration is tracked 


Does it always reflect the original registration in Maricopa County or can someone transfor a registration from 
another county? 


The date of registration will always reflect the original date of registration in the county where t! 
voters in their jurisdict 
County can process and r 2.6 m but we do not keep records of Pima County voters. 


voter registration between cov 
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5.6.9.1 REFERENCES 
¢ ARS. § 16-152 — Registration Form” 
¢ ARS. § 16-120 - Eligibility to vote*® 
¢ ARS. § 16-101 ~ Qualifications of registrant 





5.6.9.2 DATA FILES UTILIZED 


























File Name MDS5 Hash 

Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 

Maricopa County-VM34 Voter Registration Oct 2, 2020 99a4440ae9bab7f0de96d7656b4e739d 

Maricopa County-VM34 Voter Registration Nov 7, 2020 d7bfc018296832836d2bd8de440cba53 

Maricopa County-VM34 Voter Registration Dec 4, 2020 255f69007b253c7f2737b050c439f269 
5.6.9.3 RECOMMENDATION 


Legislation should be considered that would require applications developed and utilized for voter rolls or voting to be 
developed to rigorous standards that ensure the confidentiality and integrity of the systems. Specifically, its 
recommended that the Open Web Application Security Project (OWASP) Application Security Verification Standard 
(ASVS) Level 3 be applied to all applications associated with voter rolls or voting and that it be required that this be fully 
validated no less than once every two years. 


42 https://www.azleg.gov/ars/16/00152.htm 
43 https://www.azleg.gov/ars/16/00120.htm 


 https://www.azleg.gov/ars/16/00101.htm 
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Ballots 


5.6. LODUPLICATE VOTER IDS Impacted _ 


Individuals were found within the voter rolls that had the same first name, last name, shared an address at one point in 
the past, and their birth years were within 10 years; suggesting they’re the same person, but multiple Voter IDs. In all 
186 cases both Voter!Ds voted in the 2020 General Election. 


NOTE: All Voter ID’s associated with this finding can be found in Appendix Q1. This finding is not any clear indication of 
wrongdoing, and if wrongdoing occurred it may or may not have been the result of the individual whose Voter ID is 
listed in this report. It is recommended that the Attorney General follow-up further and determine if any additional 
action is needed. 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 


| Party [| 
Republican Party 30.77% 


Prefer Not to Declare 15.93% 
5.49% 
1.65% 





5.6.10.1 DATA FILES UTILIZED 


Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 
Maricopa County-VM34 Voter Registration Nov 7, 2020 d7bfc018296832836d2bd8de440cba53 





5.6.10.2 RECOMMENDATION 

Legislation should be considered that requires the periodic review of the voter rolls for duplicate entries by the same 
name and year of birth. Legislation should also be considered that would require voter registration to validate that no 
other registered voter on the rolls registered with the same valid identification. This would prevent both accidental and 
purposeful multiple registrations. 
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Ballots 
5.6.11 MULTIPLE VOTERS VINKED BY AFFSEQ. Impacted 108 


Each voter registration form has a unique, preprinted number on it much like a serial number on paper currency. This 
number is called an affidavit sequence number or AFFSEQ. It is preprinted, usually in the upper right-hand corner of 
every registration document. Each unique AFFSEQ number represents the specific registration document it is preprinted 
on. 


Below is an example of an actual AFFSEQ number preprinted on a voter registration document. This specific AFFSEQ. 
number i should only ever be associated with the voter and voter ID that filled out and signed this 
registration form this number was printed on. 


The County uses AFFSEQ numbers and their corresponding registration documents to record any changes or updates to 
an individual voter's registration record. Every time a voter fills out a registration document, whether it be to register for 
the first time or to update their registration information with an address change, party change or signature update, the 
AFFSEQ number preprinted on their form is recorded in their voter record along with the date the form was signed by 
the registrant. A digital image of each registration document is created. The image is titled with the AFFSEQ number of 
the document it represents. The AFFSEQ identifier number is unique to each transaction, unique to the voter, and 
should never be repeated. As with paper currency, if more than one bill is found with the same serial number, then the 
bills are examined to determine which bill is the original and which is the duplicate. 


Comparing the VM55 Final Voted file to the Maricopa County monthly VM34 files across time, between January 6, 2018- 
June 6, 2021, resulted in 5,711 instances where an affidavit sequence number was shared by multiple voters. It was 
confirmed with the County that AFFSEQ numbers are unique to the voter and should never be repeated. 

(On Aug 30, 2021, at 11:52 AM, voterinfo - RISCK <voterinfo@risc maricopa gov> wrote’ 

Good morning [BEE he AFFSEQs refers to Affidavit sequence. Each transaction by a voter will 


result in an affidavit. The affidavit could be a modification to your registration such as address change, 
Wit identifier is also applied to the affidavit 









party change or an updated signature as an example. An a 
envelope, or a provisional ballot used during an election jentifiers are unique (o each transition 


and never repeated. 


Thank you for your questions. 


OFFICE OF MARICOPA COUNTY RECORDER 
1115. 3RD Ave, Ste. 103, Phoenix, AZ 85003 
(602) 506-2543 Email: voterinfo@riscmaricopa.gov 








Of the 5,711 instances of AFFSEQ numbers shared by multiple 2020 General Election voters, at least one vote was cast. 
* In 101 of these instances, BOTH voter IDs linked by AFFSEQ voted in 2020 General Election. 


160,223 AFFSEQ images were provided which is an extremely small percentage of the total AFFSEQ images that are 
recorded over time. 
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Upon examining hundreds of these AFFSEQ registration document images of voters sharing the same AFFSEQ number, it 
was found that: 


e The same person is being assigned more than one voter ID number. 
e Voter identities and their voter ID are being associated with other individuals with different names, addresses, 
identifying information and even of the opposite gender 


The registration document images of all shared AFFSEQ numbers need to be examined to determine which associated 
voter is correctly associated with the document. 


Three samples of the types of issues we found in the 5,711 instances are documented below. 
Same Person with Two Different Voter ID’s Linked by AFFSEQ-Both Voter IDs Voted in GE2020: 


In this sample instance, the same person, with her name misspelled in the voter registration database, shares an AFFSEQ 
with herself and also has two voter IDs. In the images below you can that the same person filled out two registration 
forms 10 days apart, she was given a unique voter ID in each instance even though both forms were filled out with the 
same name, address, birth date and phone number. A vote was cast by mail-in ballot for both voter IDs. 


VOTER ee porters pos | Date of vM 34 Initial Ges cheree Mss 
iD Year | Registration | FileName | AFFSEQ See BALTYPE 
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Same Person with the Secondary Voter ID Given a Different Name and Address-Both Voter IDs Voted GE2020: 


The first image below shows the voter information for two voters that share the same AFFSEQ number, 


County records show that in the 1/6/2018 VM34 file that iin! shared the same AFFSEQ number 


with I These two voters have different names, addresses, and birth years. 


In the registration image below, you can see that J Lancaster filled out a registration form on 4/10/2018. The preprinted 
AFFSEQ number on the form was =a ists his birthyear as 1978 on this form. It is listed as 1975 in his 
voter record. He included his driver’s license number as identifying information. On this form in the lower right-hand 
corner, a county employee wrote the voter ID number , identifying the connection with that voter ID. In row 1 
of the voter record below, you see that voter ID number belongs to not i. The County 
employee identified that J Lancaster was connected with in some way. The date the County employee stamped 
this form is April 23, 2018. Both voter IDs were used to vote in the 2020 General Election. 


In row 2 you can see that J Lancaster has a voter ID number of 7. address in the VM34 record is 


in Phoenix. This corresponds with his voter registration form below. 











Initial 
VOTER Nae pies Birth Date of M34 File Initial Change Linked Pe 
ID Year | Registration Date AFFSEQ. Effective AFFSEQ. E 
Date 
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Male Voter Filled Out Regsitration Form but a Female is Recorded as Associated with His Registration Form, Both Are 
Linked by AFFSEQ-Both Voter IDs Voted GE2020: 


Just as no two voters should share an AFFSEQ number, no two voters should share a voter ID number. The County 
confirmed that voter IDs are generated automatically and that they are never reused. It was found that not only are two 
voters sharing an AFFSEQ number, but they are also sharing a voter ID number. 


registered to vote on 9/25/2018. The AFFSEQ on his registration form is i. He was given 
voter ID number of In row 1 below you can see that his voter ID number is now associated with a 
female, at a different address in Phoenix. This unknown person who is using original voter ID voted 
in the 2020 General Election using a mail in ballot ay voted in person on election day. 


filled out a registration form again on a. He was given voter ID number =| 


voted in 2020 General Election in person at the polls. We do not have an image of this voter registration as it was not in 
the limited AFFSEQ images supplied to us by the County. 
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VOTER rear Ae Birth Date of M34 Initial Initial Change Linked M55 
ID Year | Registration | FileDate | AFFSEQ | Effective Date AFFSEQ. BALTYPE 





NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 























Party % 
Democrat Party 42% 
Republican Party 33% 
Prefer Not to Declare | 22% 
Independent | 2% 
Libertarian Party | 1% 








NOTE: Please see Appendix R1 for a complete list of users who have shared an AFFSEQ. 
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5.6.11.1 REFERENCES 


© State of Arizona — 2019 Elections Procedures Manual” 


5.6.11.2 DATA FILES UTILIZED 





File Name 


MD5 Hash 





Maricopa County-VM55 Final Voted Nov2020 PBRQ. 


43070bc7afdf40a37cd45092e9733654 





VM34_20170107_113131.txt 


fb675c6b6ad9757759ale686ce87al7F 





VM34_20170204_104417.txt 


02a1003bf8ddc1a0cc547032c73505db 





VM34_20170305_102136.txt 


708ea30d01595f1552892a13e1clleeb 





VM34_20170409_044850.txt 


9b25f73a824589bd70e20fe02cb1F703 





VM34_20170506_094005.txt 


d8bbaacbaffba5321ac4b22d7aaebfSe 





VM34_20170604_014543.txt 


ecb6f6760b313b135c6a9ba7e4d6369a 





VM34_20170708_091800.txt 


76c897e712aba7607 2dff3fb68e8d29c 





VM34_20170805_111659.txt 


ad9f1e228123d67c9774d5c4de3a4442 





VM34_20170903_031323.txt 


O5Scfd1aal1f82392f99c65e394d526470 





VM34_20171008_021223.txt 
VM34_20171103_103144.txt 
VM34_20171203_070930.txt 
VM34_20180106_024335.txt 
VM34_20180203_063848.txt 
VM34_20180302_095453.txt 
VM34_20180406_081509.txt 


6e199b2b3fc9a98c78d4c3ee76727720 
¢7890363fbaflde622af2f589d0a48d4 
b796c93976f7d89cd53d09a26406fcaf 
74823063c6c04beb0ae2ba94789992b8 
6b55c00202aa4edb39bb47bac27e7545 
8c6e9e7edaaff58b2b4635c3ad56369c 
fc3f8d71d9cdfebc10aeaf7fb5c4290b 





VM34_20180504_093125.txt 
VM34_20180602_102915.txt 
VM34_20180707_024237.txt 
VM34_20180803_115351.txt 
VM34_20180907_091404.txt 


fa683fa02fd0d9bfcbc52a106af6873e 
c99fd11d76648af61948842161d1d197 
b6141774c149ea2f7695e230d5f78eb9 
351a3107ef1a7e5a907c1137393216ee 
62e7d11db59dbb5be078b7a3374125be 





VM34_20181005_112120.txt 


1b07988566c762821d625a0477269d3c 





VM34_20181102_105026.txt 


cb73855d70509a13a52beedde18666a3 





VM34_20181209_032523.txt 


9838a26c37f016d0e87adb43a9501707 





VM34_20190106_084008.txt 


6f4be0c41404d12bb0f6fFE9d8F27a28 





VM34_20190202_063949.txt 


cc8a7b9b1cf66a9b8fce0905df7 1af74 





VM34_20190302_090830.txt 


15ec5c127b37ec91c1c14708e7a9421d 





VM34_20190405_074946.txt 


fb6ecbf069154cbb8149d4af8348c6c4 





VM34_20190503_080954.txt 


b130edae7a4ae04afcf8e459c085fc2d 





VM34_20190608_035533.txt 


301287923fc8327b259c286712f0b38c 





VM34_20190705_102047.txt 


b89551ec6616a148a0a6eb0d9a9eb9a4 





VM34_20190802_093213.txt 


b2517193b03f9820c3588789890cd505 





VM34_20190906_115511.txt 


7fe4f70c92e995a87cd67c69feac348a 





VM34_20191005_075436.txt 





30cd819a5b53759ebd9b35fcf4f2f515 





45 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
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File Name 





MD5 Hash 





VM34_20191206_062132.txt 





4d7d56540c50bcb9efd53882f65dafa9 





VM34ALL_20201107_003451.txt 


d7bfc018296832836d2bd8de440cba53 








VM34_20200103_062658.txt 


ea5eb36acb1f3a20204fc860578755bc 








VM34_20200208_124009.txt 


cb840187d01b8d26f4a192a29de0729a 








VM34_20200306_114048.txt 


92b41e30958182e994ff86b5600c9002 








VM34_20200403_113114.txt 


5460b45b91f6709ee118e2385020b102 








VM34_20200502_014453.txt 


c44bf7968e9bf4fde446f5c43da584ef 








VM34_20200606_001100.txt 





1d8b12eea610b5b55f07d9fad1d8af80 





VM34_20200703_213734.txt 






47afb6e874c859a08c4105f912981330 





VM34_20200808_004341.txt 


8cb279714659f945f154129ea757f677 








VM34_20200905_001156.txt 


11ec4b2896389484429edbabb5a717bd 








VM34_20201002_235246.txt 


99a4440ae9bab7f0de96d7656b4e739d 








VM34_20201204_214820.txt 


255f69007b253c7f2737b050c439f269 








VM34_20210101_194641.txt 


55e2e5308c1c818ab64e58b2952d63cc 








VM34_20210205_184914.txt 
VM34_20210305_191848.txt 
VM34_20210402_214448.txt 
VM34_20210507_194658.txt 
VM34_20210604_190336.txt 

















5.6.11.3_ RECOMMENDATION 
Legislation should be considered that would 


3c1a1c1a8400464de6a4730d4e50f6c3 
af6f78181173c9e7cad7e5f17029dd20 
2fa8Ff197af888c6e0604ac9ca849aalb 

3a7e950b1d9e0d657a4a45e0b22506a5 
30f1fe36cSad4eac2a7ca5508663b9bf 


















require applications developed and utilized for voter rolls or voting to be 


developed to rigorous standards that ensure the confidentiality and integrity of the systems. Specifically, its 
recommended that the Open Web Application Security Project (OWASP) Application Security Verification Standard 
(ASVS) Level 3 be applied to all applications associated with voter rolls or voting and that it be required that this be fully 


validated no less than once every two years. 
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Ballots 


5.6.12DouBLE SCANNED & COUNTED BALLOTS Impacted = 


While examining batch discrepancies between the hand count and the Maricopa County Cast Vote Record (CVR) totals, 
we discovered that the county double counted ballots. We continue to review the Dominion images to identify the total 
number of double counted ballots. EVC4/10-26 thru 10-28/3385 which has a 50-ballot discrepancy is presented as an 
example below. The image shows one of 50 ballots that were tabulated twice giving each associated voter — two votes. 





EV BGTCN 19/7] 


5.6.12.1 DATA FILES UTILIZED 




















File Name MD5 Hash 

Maricopa County Transfer Manifests N/A 

Maricopa County Daily Ballot Summary N/A 

Maricopa County 2020 General Election Cast Vote Record | ¢31a2f34714b7582cb17e907be3152e0 
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5.6.12.2 RECOMMENDATION 


Maricopa County officials should audit the tabulation process daily to ensure no batches are scanned and tabulated 
multiple times. 


Ballots 
5.6.13UOCAVA ELECTRONIC BALLOTS DOUBLE COUNTED Impacted 


During our hand count, we identified multiple UOCAVA ballots that had been printed and duplicated more than once 
(e.g., Double Votes). Below is one example of one double printed UOCAVA ballot that was assigned two different serial 
numbers and submitted for duplication. This would result in two votes being counted for this one voter. 





5.6.13.1 REFERENCES 
© EAC - 2018 UOCAVA Data Set “° 


5.6.13.2 RECOMMENDATION 


Legislation should be considered which would require that systems utilized for UOCAVA would keep track of and help 
prevent the double-printing of ballots. 


48 https://www.eac.gov/research-and-data/datasets-codebooks-and-surveys 
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5.6.14DUupPLicATE BALLOTS REUSE SERIAL NUMBERS 


Ballots 
Impacted 


Duplicate Ballots were found reusing serial numbers. Without unique serial numbers its near impossible to match an 
original ballot (DSD) with its duplicated ballot (DUP). 


Below is an example of a serial number used multiple times: 




















EVH1/11-11/DUP 175044 DUP DUP294104 
| Original Damaged Ballots SD 8 DSD DUP294104 
| Original Large Print Sent to Duplication 2 DsD DUP294104 
| DSD RANDOM SAMPLE REVIEW 2 DsD DUP171329 
| EVH1/11-07/DUP9582 DUP DUP171329 
| Original Damaged Ballots SD 8 DSD DUP171329 





5.6.14.1 REFERENCES 


© State of Arizona — 2019 Elections Procedures Manual 
s at the counting center®* 





5.6.14.2 RECOMMENDATION 


147 


Legislation should be considered that would explicitly require each damaged ballot to have a unique serial number in 


order to match it up with its original. 


47 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 


48 https://www.azleg.gov/ars/16/00621.htm 
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5.7. Informational Findings 





Ballots 


5.7. 1AUDIT INTERFERENCE Impacted N/A 


Runbeck Election Services is a privately owned company that provided election services including the printing of all mail 
ballots for Maricopa County in the 2020 General Election. Prior to the start of the audit, members of the audit team 
conducted research into the paper, ink, toner and format of the official ballots. As part of that research, the audit team 
contacted Runbeck CEO, to ask several general questions about the ballots used in the 2020 General Election. Initially, 
the CEO agreed to a call but then asked for the questions in writing. As requested, the audit team sent Mr. Ellington 5 
general questions via email. Mr. Ellington responded to that email and said that Maricopa County instructed him that 
vendors, even private companies, should not speak with auditors. Maricopa County refused to provide the information 
about the ballot paper and ballot printing and then interfered with the auditor’s communication with Runbeck, a private 
company that does business with hundreds of other jurisdictions and entities. 


5.7.1.1 RECOMMENDATION 
Legislators should consider legislation that would prohibit interference with legislative investigations under a criminal 
penalty. 


Ballots 


5.7.2 BATCH DISCREPANCIES Impacted N/A 


A comparison of our hand count totals to the CVR totals has revealed numerous discrepancies. We are in the process of 
comparing the Dominion images of ballots to determine the cause of the discrepancy. Below are two examples of 


discrepancies. 
6841, 6835, 6553, 6875, 6966, 6717, 6807 











EVC1/10-31/6841 


Above: Maricopa County Ballot Transfer Manifest showing EV batches in the box. 











Above: Maricopa County Daily Ballot Summary for 10-31-2020 Tabulator C1. Note that BTC Batch 40 has 95 ballots and 
BTC Batch 41 has 104 ballots which combine to make up EV Batch 6717 which should have 199 total ballots. 
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06001_ 00042 06001 
06001_ 00043 06001 
06001 00044 06001 














The CVR summary, pictured above, shows that BTC Batch 40 had 200 ballots tabulated and BTC Batch 41 had 199 ballots 
tabulated. These numbers do not match the Blue Sheet totals. Pallet 7 Box EVC1/10-31/6841 has only 1396 ballots but 
the CVR shows 1500 ballots. This results in a discrepancy of -104 ballots. 


5.7.2.1 DATA FILES UTILIZED 


File Name [MosHeshSSCS~*S 
Maricopa County Transfer Manifests 


Maricopa County Daily Ballot Summary 


Maricopa County 2020 General Election Cast Vote Record | c31a2f34714b7582cb17e907be3152e0 





5.7.2.2 RECOMMENDATION 
Maricopa County officials conduct daily audits and quality control measure to reduce errors. 
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Ballots 
5.7.3COMMINGLED DAMAGED AND ORIGINAL BALLOTS Impacted vA 


The 2019 Election Procedure Manual requires that all original damaged ballots sent to duplication be placed in an 
envelope or container labeled “Ballots that have been duplicated.” The County delivered boxes of ballots that were 
commingled and incorrectly identified. Batches identified on the manifest as original ballots were, in fact, machine 
duplicated ballots. The auditors could not rely on the County’s description of ballot boxes or batches identified on the 
manifest. Hours of careful examination were required to unravel the inaccurate documents provided to ensure that 
votes were not counted twice. 


As an example, in Box EVH1/11-07/MC17349, the manifest shows that there are 14 batches of original ballots. When the 
auditors opened the boxes to count the ballots, they observed 7 batches of original ballots, 8 batches of duplicate 
ballots and one batch missing from the manifest. Batches of duplicate ballots in boxes of original undamaged ballots is a 
difficult issue to unravel. During the hand count, we also identified several instances of damaged ballots in boxes with 
original ballots. We are unable to determine if the damaged ballots had been duplicated and tabulated as duplicates. 
The Election Procedures Manual makes it clear that damaged ballots sent to duplication must be separated and the 
County did not consistently adhere to this rule. 


The Arizona Secretary of State claims that duplicate ballots and the original damaged ballots sent to duplication are to 
be segregated. In case No. CV2020-015285, Roopali Desai represented Arizona Secretary of State Katie Hobbs and said: 


THE COURT: And those are segregated? I'm — those-- they don't get put in the pile where we're not going to be 
able to find them anymore, right? We know where those are? 


MS. DESAI: Duplicated ballots are -- those are --the original as well as the duplicated ballots are, by statute, 
segregated and preserved. 


5.7.3.1 REFERENCES 


e Arizona Supreme Court Case — CV2020-015285*° 
¢ State of Arizona — 2019 Elections Procedures Manual°° 








S32, RECOMMENDATION 


All duplicated ballots should be separated and properly identified as duplicates. All original damaged ballots sent to 
duplication should be separated and properly identified in compliance with the EPM. 


4° https://www.supremecourt.gov/DocketPDF/20/20-809/163521/20201211121632424 12-11- 
20%20Appendix%20Ward%20v%20Jackson.pdf 
5° https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 
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Ballots 
5.7.4EarLy Votes Not ACCOUNTED FOR IN EV33 Impacted N/A 


The EV33 Early Voting Return Files do not contain entries for 255,326 Early Voters which are recorded in the VM55 Final 
Voted File. Individuals that vote as part of Early Voting, either by mail or in person, should have an EV33 entry related to 
their casting of a vote containing details as to when and how that vote was cast. Without an EV33 these details are 
unavailable, and it could make some types of audits impossible. 











Ballot Type Number of Voters 
B - Early Vote - In-Person 38.817 
[.R- Early Vote - Mail-In 187,823 | 





NOTE: Please see Appendix $1 for a complete list of the entries from the VMS55 file without EV33s. 


5.7.4.1 REFERENCES 
¢ AJR.S. § 16-558.01 — Mailing of Ballots* 


© ARS. § 16-246 ~ Early Balloting 
© ARS. § 16-542 — Request for ballot®® 


5.7.4.2 DATA FILES UTILIZED 


File Name 

EV33-1377-10-09-2020_101111.txt 
EV33-1377-10-12-2020_113210.txt 
EV33-1377-10-13-2020_111553.txt 
EV33-1377-10-14-2020_112757.txt 
EV33-1377-10-15-2020_121331.txt 
EV33-1377-10-16-2020_113522.txt 
EV33-1377-10-19-2020_111708.txt 
EV33-1377-10-20-2020_112351.txt 
EV33-1377-10-21-2020_111843.txt 


MDS Hash 
f1daa7089f7300237f6b4ff779661cf9 
72e4e6c102e3539b4dd15b4454357b69 
9b14841281c031533322b50aabb86a24 
1b7537d7d9b927dbf4e462ed5ee8f97c 
dec7d08dde4970c26e32b8c844f4a9ab 
£0a632c3fd9b5f177d48504dc119be31 
db80b692a9188add0844a8974e227287 
57d1795db8be71d516e29350e347fb3a 
56c3b5a11651c68735164c578eadede1 





EV33-1377-10-22-2020_111714.txt 


03551f170bf758efc90c013d0fe2e467 





EV33-1377-10-23-2020_112614.txt 


dbfdd369ac148723540c83f614cca454 





EV33-1377-10-26-2020_111318.txt 


Ob68adff779f59c70a530000bf989aca 





EV33-1377-10-27-2020_111413.txt 


a6fc7377bf6c6fe6653f539c5970a6f7 





EV33-1377-10-28-2020_111331.txt 


43758b9290f90d0305d5ed84aal0becb 





EV33-1377-10-29-2020_111300.txt 


410b30b06f2ca73022f27173fe114038 





EV33-1377-10-30-2020_111804.txt 


5cb44e5ea214f40227e04345d4355ff7 








EV33-1377-11-02-2020_111214.txt 


5d15bb8686a022f53400550cfe010a07 








51 https://www.azleg.gov/ars/16/00558-01.htm 


5? https://www.azleg.gov/ars/16/00246.htm 


58 https://www.azleg.gov/ars/16/00542.htm 
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5.7.4.3 RECOMMENDATION 

Legislation should be considered that requires that the various election related systems to properly integrate to give 
accurate and consistent counts between the mail-in ballots cast, mail-in ballots received, mail-in ballots accepted, mail- 
in ballots rejected, and be able to reconcile these details with who voted in the final voted file. 


Ballots 


5.7.5HIGH BLEED-THROUGH RATES ON BALLOTS Impacted N/A 


A large number of the ballots from in-person voting, primarily on Election Day (ED), experienced bleed-through where 
the marks from one-side of the ballot were clearly visible on the other side of the ballot. This does not happen when the 
manufacturer recommended paper is utilized under normal circumstances. 


The biggest concern with bleed through is if it occurs in a place that might somehow impact the reading of the ballot on 
the other side of the paper. Ballots are generally designed to minimize this potential by offsetting the races on each side 
of the paper so that if bleed-through does happen it is a safe distance away from the ballot ovals on the other side of the 
paper. Maricopa County Ballots were designed in this manner. 


The effect of this offsetting can be hampered, however, if the ballot printer is not in calibration (Please see Section 
5.7.10, “Out of Calibration Ballot Printers”). When this occurs the miscalibration causes the front of the ballot to not 
align where it was intended to on the back of the ballot. If this miscalibration is off enough it could allow the bleed- 
through to fill out a ballot oval on the other side of the paper and cast a vote, cause an overvote, or simply confuse the 
tabulator enough to send the ballot to adjudication. Out of the several thousand ballot images that were manually 
reviewed we could not find any images where bleed-through was close enough to a ballot oval to cause mistabulation, 
nor did we see any immediate correlation with adjudication. The Dominion tabulators appeared to focus on the actual 
oval and no bleed-through example was found where a ballot printer was so miscalibrated it actually filled a portion of 
the oval. 
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Figure 1 - Green is around the actual vote. The red boxes show the bleed 
through from the other side. 


5:7:5,1 REFERENCES 


¢ Dominion Printing & Finishing Specifications 





5:75.02 RECOMMENDATION 


Legislation should be considered that would require that the election equipment be properly maintained, including, but 
not limited to ensuring that ballot printers are in the proper calibration. 


6.7.5. 3INSTANCES 

Kinematic Artifact processing is currently evaluating the ballot images to do a full analysis of bleed-through. A full report 
documenting all of the bleed-through is expected in the coming weeks. At this time, this particular issue appears to be 
systemic to any non-Runbeck printed ballots. 


54 https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/SD-IC-PrintingSpecification- 
5:11-CO.pdf 
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Ballots /n 
5.7.6|MPROPER PAPER UTILIZED Impacted 


A large number of the ballots from in-person voting, utilized paper that is not recommended by the manufacturer of the 
tabulators for use in the systems. This can result in higher jam rates, more bleed through, and could theoretically impact 
the readability of the ballots by the scanners, but this last case is extremely unlikely. At this time 10 different papers 
have been found. Several of these paper stocks include paper with the weight from 20Ib to 30lbs; when the generally 
accepted best practice for voting is to utilize ballot stock of 80lbs or higher. Since this type of paper is generally not 
tested within the equipment, nor part of the Logic and Accuracy testing, the effects of utilizing it is unclear. 


The large number of papers utilized during this election and the lack of official reporting about what paper stocks were 
utilized made it difficult to identify any potential counterfeit ballots. Standardization on these details would more greatly 
facilitate future audits. 

5.7.6.1 REFERENCES 


¢ Dominion Printing & Finishing Specifications 





5.7.6.2 RECOMMENDATION 


Legislation should be considered that would require that paper stocks utilized on election day should conform to 
manufacturer recommendations to ensure that the paper that has been tested in the device is what is actually utilized to 
cast votes. Legislation should also be considered that mandates the standardization of paper utilized for the election 
including requiring that the ballot stock amounts utilized be fully accounted for and tracked. 


5.7.63 INSTANCES 


Kinematic Artifact processing is currently evaluating the ballot images to do a full analysis of types of paper utilized. A 
full report documenting all of the papers utilized is expected in the coming weeks. 


55 https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/SD-IC-PrintingSpecification- 
5-11-CO.pdf 
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Ballots 


5.7.7 INACCURATE IDENTIFICATION OF UOCAVA BALLOTS Impacted N/A 


Maricopa County identified only one box on the manifest as having UOCAVA Original Ballots sent to duplication. The audit 
team examined all other boxes of ballots and identified 6 other boxes that were inaccurately labeled. All UOCAVA ballots 
identified by the County were 8 %” X 11” copies of electronically submitted voted ballots. UOCAVA ballots were found in 
boxed labeled Braille Ballots and boxes labeled the generic Original Ballots/Damaged/Sent to Duplication. This inaccurate 
labeling of UOCAVA boxes gave the impression that there were far fewer UOCAVA ballots than were actually counted. 


Ballot Custody Transfer Manifest 
Arizona Senate Fifty-Fifth Arizona Legislature / First Regular Session Subpoena Duces Tecum 
Karen Fann, President of the Arizona Senate / Warren Petersen, Chairman of Senate Judiciary Committee 


[Original Ballots/Damaged/Sent to Duplication 
eget Satay Damaged Sent wo Deplcation 




































[Original Ballots/Damaged/Sent to Duplication 
[Braille Original to Duplication 
77 Z2| Braille Original to Duplication 
73] Braille Original to Duplication 
Print Original to Duplication 
[Large Print Original to Duplication 
[Large Print Original to Duplication 
[Election Day Damaged Original to Duplication 
[Provisional Damaged Original to Duplication 
IVOCAVA Original to Duplication 
[Data Cards -ICP2s- Election Day/USB Drives for Results 
|Uoload 
[Totals Tapes -IcP2s - lection Day 
[Totals Tapes -IcP2s - Election Day 
[Original Damaged Ballots for Duplication - Random 
[Sample Review #1 (Box 1 of 2) 
[Original Damaged Ballots for Duplication - Random 
[Sample Review #2 (Box 2 of 2) 
/ _fererel nmeeed els or tupteation- =| 
eee 
sf Nahe Coe = a 
7 Oi, 

























































“/; 4/20f: 72] 


5.7.7.1 RECOMMENDATION 


Legislation should be considered that requires UOCAVA systems to be designed in a manner to prevent potential 
multiple copies of UOCAVA ballots from being printed. 
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Ballots 


5.7.8MISSING SUBPOENA ITEMS Impacted N/A 


The original subpoena dated January 13, 2021, required Maricopa County to provide “Access to all original, paper ballots 
(including but not limited to early ballots, Election Day Ballots and Provisional Ballots).” The auditors did not receive the 
following original ballots: 


* Rejected Provisional Ballots 
* Uncured Mail Ballots 
* Ballots returned to the County as undeliverable 


Failing to receive these components prevented portions of the audit from being completed, such as validating that the 
right number of provisional ballots existed, and that ballots returned to the County as undeliverable were properly 
accounted for and were not reused in some other context. Since these items were not provided, this work was not able 
to be completed. 


Ballots 


5.7.9NO RECORD OF VOTERS IN COMMERCIAL DATABASE Impacted /A 


All voters within the Final Voted File, or VM55, was cross-checked against a commercially available data source provided 
by Melissa®® called Personator and 86,391 individuals were found with no record in the database for either their name, 
or anyone with the same last name at the address in the VMSS file. It is expected that most if not all of these individuals 
are in fact real people with a limited public record and commercial presence. It is highly recommended that this list be 
further validated with canvassing to determine what percentage of these voters represent current and valid voters. 


Personator is a best-in-class identity and address validation tool. It confirms that an individual is associated with an 
address, indicates prior and current addresses, tracks when and where the individual moves, tracks date-of-birth and 
date-of-death. To accomplish this, it utilized both private and government data sources such as the US Postal Service’s 
National Change of Address (NCOA) service, and the Social Security Administration’s Master Death List. 


NOTE: The following chart illustrates the percentage of voters by registered party that the Ballot Impacted number 
represents. This should give a rough idea on the impact to the electorate if the votes were cast by the voters and not 
another individual that was somehow able to cast a vote. 
































Party % 
Democrat Party 43.97% 
Prefer Not to Declare 29.83% | 
Republican Party 22.21% | 
Independent 2.55% | 
Libertarian Party 1.3% | 
Green Party 0.12% | 
5.7.9.1 Data Fites UTILIZED 
File Name MDS5 Hash 
Maricopa County-VM55 Final Voted Nov2020 PBRQ. 43070bc7afdf40a37cd45092e9733654 














56 https://www.melissa.com 
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5.7.9.2 RECOMMENDATION 


Legislation should be considered that requires a periodic review and maintaining of the voter rolls to be sure it 
represents current Arizona residents. 


Ballots N/A 
5.7.100UT OF CALIBRATION BALLOT PRINTERS Impacted 


A large number of ballots appear to have been printed on printers not properly calibrated. This means that the front- 
page of the ballot is not consistently aligned with the back page of the ballot. The way this alignment presented 
appeared to be unique for each vote center printer. This is contrary to manufacturer guidelines and recommendations 
and could theoretically result in inconstant reading of votes across all the different tabulators, although we identified no 
instances of this issue causing a ballot to be tabulated incorrectly in the several thousand images reviewed. 
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5.7.10.1 REFERENCES 
© Dominion Printing & Finishing Specifications*” 





5.7.10.2 RECOMMENDATION 


Legislation should be considered that would require that the election equipment be properly maintained, including, but 
not limited to ensuring that ballot printers are properly calibrated. 


5.7.10.3 NSTANCES 
The Kinematic Artifact processing is currently processing ballot images to fully map all printer miscalibrations. A full 
report is expected in the coming weeks. 


Ballots 
5.7.11 REAL-TIME PROVISIONAL BALLOTS Impacted 





N/A 


The Arizona Secretary of State Elections Procedures Manual identifies circumstances that require the issuance of a 
Provisional Ballot. If a voter appears in the e-pollbook or signature roster as having received an early ballot by mail, but 
the voter wants to vote in person on Election Day, that voter must be issued a Provisional Ballot. However, Maricopa 
County reported 58,550 voters who had received mail ballots but were issued standard ballots on Election Day. The 
County identifies these as “real-time Provisional Ballots.” There is no mention of real-time provisional in the AZ Elections 
Procedures Manual. In fact, the EPM specifically addresses this circumstance and is clear that such voters must be issued 
a Provisional ballot. 


There appears to be no statutory authority for Maricopa County to deviate from the EPM and issue standard ballots to 
voters who had already received a mail ballot. We identified no instances of these voters casting more than one ballot, 
however. 


This was reported as a note at the bottom of page 12,329 of the November General Election Canvass Final -below: 





Note: There were 58550 Early Ballot recepients that had not RETURNED their 
Early Ballot and consequently were issued a standard ballot on Election Day. 
These were processed as real-time Provisional Ballots. 








A.R.S. § 16-579(F). Issuing a Provisional Ballot 


1. Circumstances Requiring Issuance of a Provisional Ballot: 
Voter Received an Early Ballot 
A voter must be allowed to vote a provisional ballot if the voter appears on the signature roster or e-pollbook as 
having received an early ballot-by-mail, but either: 
(1) affirms that they have not voted and will not vote the ballot-by-mail; or 
(2) surrenders the ballot-by-mail to the inspector on Election Day. A.R.S. § 16-579(B) 
Voters who appear at a voting location with a ballot-by-mail that has not been voted, along with the affidavit 
envelope, may use a privacy booth at the voting location to mark the ballot-by-mail. In this circumstance, the voter 


57 https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/SD-IC-PrintingSpecification- 
5-11-CO.pdf 
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does not sign in and the voter must place the voted ballot-by-mail in its affidavit envelope, sign the affidavit 
envelope, and place the envelope in the early ballot drop-off container at the voting location. 


5.7.11.1 REFERENCES 


© State of Arizona — 2019 Elections Procedures Manual 


e A.R.S § 16-579 — Procedure for obtaining ballot by elector? 


158 





5.7.11.2 DATA FILES UTILIZED 


File Name MD5 Hash 
| 11-03-2020-0 Canvass COMPLETE NOV2020 | ce62ccO61b6bb56b4fd40aa4866adb16 











5.7,11;3 RECOMMENDATION 
Maricopa County should explain this deviation from the Elections Procedures Manual. 


Ballots 


5.7.12VOTER REGISTRATION SYSTEM AUDIT ACCESS Impacted N/A 


One of the most important components of the audit was the analysis of the voter registration system and records of 
authorized or unauthorized access to that system. Our audit team has been denied the access required to complete this 
portion of the audit. In the Senate’s subpoena dated January 12, 2021, Maricopa County was ordered to provide the 
auditors access to, or control of all equipment used in connection with the administration of the 2020 election. Ina 
second subpoena, dated July 26, 2021, the County was ordered to provide all reports, finding and other documents 
concerning the voter registration breach. The response from the County claims that they are not aware of a breach. 





1, "All reports, findings and other documents concerning any breach of the yoter registration server, the 
Maricopa County Recorder’s Office systems, or any other aspect of the Maricopa County elections systems 
at any time within six months of the November 3, 2020 general election" 


The Board of Supervisors is not aware of any “breach”, as stated above, occurring during this time period, or any 
other time period relevant to the November 3, 2020 election. The Board of Supervisors is aware of an incident in 
November 2020 wherein an individual programmatically accessed the County Recorder’s website and gathered 
publicly available information for a short period of time. The Recorder's website is in no way connected to the air- 
gapped tabulation system in the secure room where ballots are counted. To the extent you are requesting records 
related to this incident, you recently made a public records request to both the Maricopa County Recorder and the 
Board of Supervisors requesting similar information. As always, the Board of Supervisors will comply with your 
public records request promptly consistent with Arizona law. We hereby request that you accept our response to 
your public records request in lieu of production pursuant to this subpoena. 











Claiming that this breach was nothing more than unauthorized access to public data has not been supported with 
evidence. According to a news article published December 4°", 2020, Maricopa County confirmed voter data had been 
stolen and that a federal investigation was under way. CISA considers voter registration systems to be critical 
infrastructure and thus requires states and counties to implement the highest levels of security. The only way to ensure 
that there is one vote for every legally registered voter is careful control of the voter registration database. 


58 https://azsos.gov/sites/default/files/2019 ELECTIONS PROCEDURES MANUAL APPROVED.pdf 


59 https://www.azleg.gov/ars/16/00579.htm 
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57.121 REFERENCES 


e Maricopa County Letter to Arizona Senate 
e Cybersecurity and Infrastructure Agency (CISA)®* 








5.7.12.2 RECOMMENDATION 


Legislation should be considered that would require applications developed and utilized for voter rolls or voting to be 
developed to rigorous standards that ensure the confidentiality and integrity of the systems. Specifically, its 
recommended that the Open Web Application Security Project (OWASP) Application Security Verification Standard 
(ASVS) Level 3 be applied to all applications associated with voter rolls or voting and that it be required that this be fully 
validated no less than once every two years. 


Ballots 


5.7.13QUESTIONABLE BALLOTS Impacted N/A 


Analysis of the paper ballots has discovered ballots which exhibit characteristics that are anomalous and do not match 
known legitimate ballots. This includes color ballots that are missing Machine Identification Codes (MIC), as well as 
ballots that are demonstrating consistent printing irregularities that suggest they were not printed with the standard 
ballot PDF generated from the Dominion Election Management System (EMS). These irregularities may have logical 
explanations, but these explanations are not immediately evident. 


NOTE: The questionable ballots have been reviewed to determine if they favor one presidential candidate over another 
presidential candidate. No discernable pattern could be determined. This highly suggests that these are not counterfeit 
but do require some sort of explanation. 


9.7.13.1 REFERENCES 
e Maricopa County Election Facts and Myths 


e —Runbeck Printing Website 
© HP PageWide WebPress T HD Specification™ 








5.7.13.2 RECOMMENDATION 


Legislators should consider passing laws standardizing the papers and printing process utilized for printing ballots and 
requiring documentation to be kept of all papers utilized. This will facilitate determining if a ballot is in fact genuine and 
remove any areas for confusion. 


‘www.maricopa.gov/DocumentCenter/View/70435/Final-Signed-Letter-to-Senators 
‘www.cisa.gov/election-security 

® https://recorder.maricopa.gov/justthefacts, 

®3 https://runbeck.net/election-solutions/election-printing-mailing, 

°4 https://www.hp.com/us-en/commercial-industrial-printing/pagewide/t250-hd-web-presses.html 
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6 VOTING MACHINE FINDINGS 





The following section outlines all findings related to the voting machines including the analysis and discoveries during 
the Voting Machine phases of the work. 


6.1 Voting Machine Scoring 

Cyber Ninjas utilizes a risk ranking system based on the 
guidelines outlined by NIST publication 800-30, “Guide for 
Conducting Risk Assessments — Information Security.” A 
severity is assigned to a finding based on a combination of 
the likelihood the finding could impact the election, or the 
ability to audit the election and the impact it could have on 
the election results. 








Likelihood | Low Medium | High 





Table 1: Election Risk Matrix. 
Both the likelihood and the impact of the finding are rated 


independently on a scale from “Low” to “Critical.” These ratings are then combined utilizing the risk matrix represented 
in Table 1 to determine the associated severity for the issue. 


6.2 Digital Analysis Summary 





Because the Maricopa County Board of Supervisors and the Arizona State Senate have recently settled their dispute 
concerning outstanding subpoena items, this portion of the audit is not yet complete. Analysis of those items that were 
produced, however, clearly demonstrated that the Maricopa County voting systems did not follow CISA or industry 
standard cyber security best practices. 


First Maricopa County personnel did not control the administrative iButton credentials necessary to configure, validate 
and certify the ICP2 tabulators. Second, Maricopa County did not properly assign and manage the user names and 
passwords necessary to restrict access the voting systems. The user accounts were not attributable to an individual, 
rather they were shared throughout the staff. Furthermore, the same password was utilized by multiple accounts and 
was never changed since the installation of the Dominion software. That same password was used by both 
administrative and user accounts. If a user had access to user level account, that user had all the knowledge necessary 
to perform administrative functions with elevated access. Third, the windows security and activity logs were not 
preserved for the required 22 months following the election, thus significantly hampering the analysis of authorized 
activity. It did appear that the Dominion software specific logs were preserved, but those logs do did not provide the 
same level of detail or data that the Windows operating system logs did for security events, remote login events or other 
user activity. Fourth, there was a clear lapse in the hardware configuration monitoring and baseline in the Maricopa 
County voting systems as evidenced by the presence of an unauthorized second bootable hard drive in the Adjudication 
2 workstation. 


6.3. Summary Table 














# Finding Name Likelihood Impact Severity 
6.4.1 Election Management System Database Purged High High High 
6.4.2 Election Files Deleted High | High High 
6.4.3 Corrupt Ballot Images High | High High 
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6.5.1 Missing Ballot Images Medium High Medium 

6.5.2 Failure to Follow Basic Cyber Security Practices Medium High Medium 

6.5.3 Subpoenaed Equipment Not Provided Medium High Medium 

6.5.4 Anonymous Logins Medium Medium Medium 

6.5.5 Dual Boot System Discovered Medium Medium Medium 

6.5.6 EMS Operating System Logs Not Preserved Low High Medium 
0 Election Data Found from Other States Low Medium Low 














6.4 High Findings 








6.4. LELECTION MANAGEMENT SYSTEM DATABASE PURGED Ukelihood: = High Impact: High 


The Election Management System (EMS) database which holds all details associated with the 2020 General Election was 
purged and all the election results were cleared by a Results Tally and Reporting Admin on February 2 at 5:14 pm; the 
evening before the Pro V & V audit was scheduled to officially start. This means that these results were not available for 
Pro V & V or SLI to perform any type of audit, nor were they available for Cyber Ninjas to review. The next day ProoV & V 
then proceeded to add new tabulators for their audit, and they imported results into these tabulators further clearing 
remnants of the database. It is worth noting that the Dominion software fully supports creating a full copy of an existing 
election project; and if a cleared database was required for Pro V & V to perform their audit, they could have first 
duplicated the existing Election Project. Neither of the “auditors” retained by Maricopa County identified this finding in 
their reports. 


NOTE: While the log file clearly indicates that the results and images were also purged as part of the process, the 
majority of the images did appear to be reloaded back to the system at some point. There were images missing and a 
number of corrupt images as can be seen in the other findings. 


NOTE: On August 26" the Maricopa County Board of Supervisors was requested to explain the reasoning for this activity 
but has chosen not to respond. 


Figure 2 - UserLog shows that RTRAdmin Successfully Purged the 20201103 Election Database and Files. 
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Tabulator Nu... | Name Location ‘Type ‘Counting Group | Log File Closed Images Loaded 

157189 Audit 7 Maricopa ICE/ICP 2 EARLY VOTE M4 [7] 1 
3002 HiPro 2 E: MCTEC Ce... [EARLY VOTE 1 
157192 ‘Audit 10 Maricopa ICE/IcP 2 EARLY VOTE Oo mI a 1 
157191 Audit 9 Maricopa ICE/ICP 2 EARLY VOTE wa) ou 1 
157193 Audit 11 Maricopa ICE/IcP 2 EARLY VOTE 1%] a 12) 1 
157185 Audit 3 Maricopa ICE/ICP 2 EARLY VOTE O (=| =] 1 
157186 Audit 4 Maricopa ICE/ICP 2 EARLY VOTE 4 u 1 
157195 Audit 13 Maricopa ICE/IcP 2 EARLY VOTE oO im w 1 
6004 Canon 4 Early... |MCTEC Imagecast Ce... |EARLY VOTE CO 1 
157190 Audit 8 Maricopa ICE/ICP 2 EARLY VOTE oO [=] t 
157184 Audit 2 Maricopa ICEACP 2 EARLY VOTE O A 4 1 
157187 Audit 5 Maricopa ICE/ICP 2 EARLY VOTE 4 ym 1 
157188 ‘Audit 6 Maricopa ICEICP 2 EARLY VOTE a wa} 1 
157194 Audit 12 ‘Maricopa IcE/IcP 2 EARLY VOTE M 4 1 
157183 ‘Audit 1 Maricopa ICE/icp 2 EARLY VOTE Oo ma] wa} 1 
3001 HiPro 1 Early... |MCTEC Imagecast Ce... |EARLY VOTE L) L] 3 

















Election Summary Report 
General Election 


Maricopa County 
November 3, 2020 


Counting Group Ballots Registered Voters Turnout 
EARLY VOTE 0.31% 
ELECTION DAY 0.00% 
PROVISIONAL 0.00% 


‘Total 2,595,272 0.31% 


Registered Voters: 8,164 of 2,595,272 (0.31%) 
Ballots Cast: 8,164 


6.4.1.1 





Figure 4 - Results for the 2020 General Election only show 8,164 votes from the Pro V & V audit. 


DATA FILES UTILIZED 














File Name 


MD5 Hash 





AZAud-E-089-1 _EMS PRIMARY\AZAud-E-089-1 _EMS PRIMARY | 95a6f531c4969dda8f5703858e33d414 
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6.4.1.2 RECOMMENDATION 

Legislation should be considered that could more greatly facilitate audits to be performed and require the counties to 
cooperate with the audits when they occur. Specifically, the county should be required to provide all the details needed 
to have a fully functional Election Management System where results can be reviewed. 


6.4, 2ELECTION FILES DELETED Likelihood: High Impact: High 


According to the Master File Table (MFT) of the drives, a large number of files on the Election Management System 
(EMS) Server and HiPro Scanner machines were deleted including ballot images, election related databases, result files, 
and log files. These files would have aided in our review and analysis of the election systems as part of the audit. The 
deletion of these files significantly slowed down much of the analysis of these machines. Neither of the “auditors” 
retained by Maricopa County identified this finding in their reports. 
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6.4.2.1.1 Deletion Activity on the EMS C:\ Drive 





The EMS server that was produced contained six hard drives. Two of those hard drives were configured in a mirrored 
configuration and contained the operating system and install programs. This mirrored drive was assigned the drive 
letter “C” and was the boot drive for the EMS. Between 10/28/20 08:52:36AM and 11/05/20 05:58:58PM 865 
directories and 85,673 election related files (scanned ballots, .dvd files, slog.txt files, etc.) were deleted from the EMS 
C:\ drive. A full listing is provided in the file named Files and Directories Deleted from the EMS C Drive.txt. 





Figure 5-Example of Election Related File Deletion from EMS C:\ Drive 
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6.4.2.1.2 Deletion Activity on the EMS D:\ Drive 


The other four (4) hard drives were configured in a 0+1 hardware raid configuration that contained a single 2.1 
Terabyte partition. For the purposes of this examination this raid was manually reconstructed and mounted as a single 
2.1 TB drive. This mounted image was then imaged using the FTK Imager software package. The resulting forensic 
image was then utilized for analysis. This drive contained the dominion election data, election definitions, the election 
databases, the NAS directory and the scanned ballot images. Between 11/01/20 10:37:41AM and 03/16/21 
10:17:06AM 9,571 directories and 1,064,746 election related files were deleted from the D drive. These deleted files 
include scanned ballot images, ICX results, context.spx files, choice.spx files, .dvd files from the tabulators, and other 
election related files. A full listing of the deletions is provided in the file Files and Directories Deleted from the EMS D 
Drive.txt. 











Figure 6-Trump Ballot Image Created and Deleted on 1 Nov 2020 from D:\ Drive 
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Figure 7-Deleted Election Results Files on 5 November 2020 from D:\ Drive 


m HiPro 1 


HiPro 1 Deleted Files and Folders — 304 Directories and 59,387 files containing election data were deleted from the 
HiPro scanner number 3 (CyFIR evidence number AZAUD-C-096) by an individual using the account hipradminO1. These 
files were deleted on 3 March 2021 between 03/03/21 12:53:34PM and 03/03/21 01:37:49PM. 


Figure 8-Deleted Election Related Files from HiPro 1 
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6.4.2.1.4 Deleted Directories and Files from HiPro 3 











HiPro 3 Deleted Files and Folders — 1,016 Directories and 196,463 files containing election data were deleted from the 
HiPro scanner number 3 (CyFIR evidence number AZAUD-C-099) by an individual using the account hipradmin03. These 
files were deleted on 3 March 2021 between 03/03/21 01:26:32PM and 03/03/21 01:37:49PM. 





Figure 9-Deleted Election Related Files from HiPro3 





6.4.2.1.5 Deleted Directories and Files from HiPro 4 
HiPro 4 Deleted Files and Folders — 981 Directories and 191,295 files containing election data were deleted from the 
HiPro scanner number 4 (CyFIR evidence number AZAUD-C-098) by and individual using the hiproadmin04 account. 
These files were deleted on 3 March 2021 between 03/03/21 02:32:47PM and 03/03/21 02:44:32PM. 
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Figure 10-Deleted Election Related Files on HiPro4 


6.4.3CorRUPT BALLOT IMAGES Likelihood: High Impact: High 


The audit has discovered 263,139 ballot images on the election system that are corrupt and unreadable TIFF format 
images. It is unclear what events could have resulted in this number of images being corrupted. The corruption of the 
ballot images in the election system only occurs for ballots that were scanned on or after November 1, 2020. No 
corruption of ballot images occurred in the 1,347,240 ballots processed on the same nine high-speed scanners prior to 
November 1, 2020. The image corruption is incongruous with the performance of those same nine high-speed scanner 
systems during the entire election prior to November 1, 2020. For each of the eight high-speed scanners used for ballots 
scanned starting on November 1, approximately half of the TIFF images are corrupted. The corruption prevents the audit 
team from confirming the efficacy of the vote totals and the correlation to the paper ballots stored in the various 
batches. 


TIFF image batches were corrupted in some way and not entirely readable for the purposes of the audit. This means that 
it was impossible to confirm that the electronically recorded votes corresponded to the corrupted TIFF ballot images. In 
this scenario it is possible that manipulation of the electronic vote totals occurred in the instances where the TIFF 
images are corrupted. These corrupt TIFF images are not in the folder structure where finally adjudicated ballots are 
held. Instead, the corrupted adjudicated ballots for “Early Vote Spare 2” are located amongst what appear to be test 
batch ballot images. 


NOTE: Because these images are critical, a new copy of these images was requested from Maricopa County, but a 
response was not given. 
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Figure 11 - Early Vote Spare 2 Misallocated and Corrupted Ballots. 





Figure 12 - HiPro 1 Early Vote Spare 2 Showing 97,098 Ballot Tiff Images, Showing the High Volume on these Devices. 
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Figure 13 - Example folder showing corrupt TIFF images. The corrupt images either will 
not display a pre-view at all, or the ballot will be partially blacked out. 


In addition, the very same nine (9) high speed tabulators processed more than 1.3 million votes from October 20, 2020, 
to October 31, 2020 without corrupting any TIFF ballot images. It is anomalous that these high-speed scanners had no 
errors for the eleven-day period prior to November 1, 2020, but had issues starting on November 1. 


NOTE: The top level of the EMS folder structure containing all of the scanner’s zip files with the unadjudicated ballots 
(except the aforementioned missing ballots) are present. The corrupted ballots by file name do appear in these zip files, 
but none of the ballots in this folder structure are adjudicated. 


6.4.3.1 DATA FILes UTILIZED 


a 


AZAud-E-08! Ms PRIMARY\AZAud-E-08: MS PRIMARY | 95a6f531c4969dda8f5703858e33d414 








6.4.3.2 REPRODUCTION STEPS 
In order to locate and find the corrupt ballots, the Unix “find” command can be employed in conjunction with the “file,” 


“grep,” and “we” (word count) command to determine if the ballot image is indeed a valid TIFF image format file. 


For example, here is the command line: 


6.4.3.3 RECOMMENDATION 
Legislation should be considered that will make ballot images an artifact from an election that is publicly published for 
increased transparency and accountability in the election process. 
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6.5 Medium Finding 





6.5.1 MISSING BALLOT IMAGES Likelihood: Medium Impact: High 


The total number of ballot images that exist within the body of computer forensics material provided for the audit is 
substantially less than the official vote totals and the total number of paper ballots audited. 21,273 ballot images are 
entirely missing from the forensics images of the election equipment. This means that there are electronic votes 
recorded, but no actual ballot images that correspond to the votes. This makes it impossible to fully validate the results 
or confirm that the Election Management System (EMS) was not tampered with. 


The results from the high-speed scanners from 11/1 to 11/13 are not found in the folder named, “20201103 General 
ballots and election files and adjudicated tabulators.” We find the bulk of them in “20201103 General\Results” folder. 
The first 15-20 (depending on the specific high-speed scanner) of these batches do not have ballot images. The total 
number of missing ballot images is 21,273. 






Figure 14 - The tabulator results are found in two different folders, "20201103 General Ballots and 
election files and adjudicated tabulators" and "20201103 General,” 
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Figure 15 - The tabulator folder that should have images within it does not have any images. 
In total 21,273 images were missing. 


6.5.1.1 DATA FILES UTILIZED 


a 





AZAud-E-089-1 _EMS PRIMARY\AZAud-E-089-1 _EMS PRIMARY | 95a6f531c4969dda8f5703858e33d414 


6.5.1.2 REPRODUCTION STEPS 


In order to find the number of ballot images, first it is necessary to query the EMS database for the election project 
name Project 20201103 General and select the vote total for the entire election using the following MS SQL command. 
This query is executed using the Microsoft SQL Server Management Studio v17.1 that was found to be installed on the 
EMS. 


Windows Domain and Logon: 
Detabase Nore: 


| 
Rie cease Sew cae eee | 


In order to count the total number of ballot images, the Unix “find” command can be employed in conjunction with the 
“grep” and the “wc” (word count) command to determine if the ballot image is indeed a valid TIFF image format file. 
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For example, here is the command line: 





Add these totals together and this is the total number of TIFF images on the EMS for the election. 


Then take the total number of ballots from the EMS from and subtract the total from the above commands. 


6.5.1.3 RECOMMENDATION 


Legislation should be considered that will make ballot images an artifact from an election that is publicly published for 
increased transparency and accountability in the election process. 


6.5.2 FAILURE TO FOLLOW BASIC CYBER SECURITY PRACTICES Ukelihood: = Medium =— Impact: High 


The Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) has published a series of 
cybersecurity best practices and guidelines. In addition to general guidelines, CISA has also published specific best 
practices for securing election systems that is available for all counties to access at no cost. In the most recent version of 
the document CISA broke this guidance into specific categories for ease of utilization. As part of these findings, this 
report will address the following CISA recommendations and address the lack of Maricopa County compliance with the 
recommendations; Software and Patch Management, Log Management, Credential Management, and Establish a 
Baseline for Host and Network Activity. 


6.5.2.1 INSTANCES 
6.5.2.1.1 Software and Patch Management 


CISA outlines the necessity for software and patch management within election systems. Specifically, CISA states 
“Failure to deploy patches in a timely manner can make an organization a target of opportunity, even for less 
sophisticated actors, increasing the risk of compromise.” It is clear that there was no established program to patch the 
operating system or even update the antivirus definitions. Neither the operating system nor the antivirus had been 
patched or updated since August 2019 (the date of the installation of the Democracy Suite). The county released a 
statement that they were prohibited from updating the operating system, that had they done so it would have 
invalidated the certification issued by the Voter Assistance Commission (VAC) for the Dominion software. This 
statement is contradicted by the County’s own actions following the installation of the Dominion software. Contrary to 
the claims that updating items on the election systems would invalidate the certification of the election system by the 
EAC, forensic analysis revealed that after the installation of the Dominion software in August 2019, 4 EXE packages 
were created, 45 EXE packages were updated and/or modified, 377 Dynamic Link Libraries (DLL) were created, and 
1053 Dynamic Link Libraries were modified on the EMS server. If updating the operating system with patches and 
updating the antivirus definition file would have invalidated the voting certification, then the county had already 
invalidated the certification prior to the general election of 2020. Neither security audit contracted by Maricopa 
County noted these findings in their report. 
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6.5.2.1,2 Log Management 











The Cybersecurity and Infrastructure Agency (CISA) recommends that organizations should set up centralized log 
management systems that 1) forward logs from local hosts to a centralized log management server, correlate logs from 
both network and host security devices, and review both centralized and local log management policies to maximize 
efficiency and retain historical data. Analysis of the systems revealed that none of these recommendations were being 
followed on the Maricopa County election systems. In fact, in a later paragraph this report details how the windows 
security logs for the EMS server were in fact intentionally deleted such that the logs no longer covered the time period 
for the 2020 General Election. Neither security audit contracted by Maricopa County noted this finding in their report. 





6.5.2.1.3 Credential Management 
The Cybersecurity and Infrastructure Agency (CISA) states that Managing passwords and using strong passwords are 
important steps in preventing unauthorized access to databases, applications, and other election infrastructure assets. 
CISA further recommends that usernames be assigned to a specific person, not be shared and be changed every 90 
days. CISA actually recommends that multifactor authentication be enabled for election systems. Key to the username 
and password concept is to be able to uniquely identify a user, assure authorized access by a given users, and to be 
able to hold that individual accountable for the actions performed by that assigned account. In the case of the 
Maricopa County election systems, none of these guidelines were followed. Neither security audit contracted by 
Maricopa County noted this finding in their report. 











Maricopa County Failed to Ensure Unique Username Allocation to Individuals 

Generic username accounts were created as part of the Dominion Software installation on 8/06/2019. These accounts 
were not assigned to a specific individual but appear to have been shared accounts based on function, not individual 
accountability. Neither security audit contracted by Maricopa County noted this finding in their report. 


Maricopa County Failed to Create Unique Passwords for Each Account 

Unique passwords were not created for each account. Just to be clear, the same password was used for all the 
accounts (if there was in fact a password for the account). This action violates every principle of password 
management guideline as published in every cyber security framework that currently exists. Below are the list of 
accounts and the corresponding password. Note the last 4 characters of the password has been masked for security 
reasons, but all 4 of those characters are the same for all accounts. Furthermore, these passwords had not been 
changed since the Dominion software suite had been installed (presumably by Dominion employees) in August of 2019. 
The recommendation from CISA and most cybersecurity frameworks recommend that passwords, especially for 
administrative accounts, should be changed every 90 days. Neither security audit contracted by Maricopa County 
noted this finding in their report. 
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Note: These passwords were subsequently used in conjunction with accessing virtual machines that were created from 
copies of the forensic images and were proven to be legitimate passwords. Neither security audit contracted by 
Maricopa County noted this finding in their report. 
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6.5.2.1.4 Lack of Baseline for Host and Network Activity 


The analysis of the computing systems that comprised the Maricopa County voting system (to the extent produced) did 
not find any whitelisting, monitoring, baselining, or network programs that could have been used to establish a 
baseline for host and network activity. CISA recommends that counties leverage software and monitoring functions to 
establish and enforce a software and a network baseline of approved programs, communications protocols, and 
communications devices for voting systems. This baseline should be monitored and integrated into an alerting and 
response capability to ensure that no unauthorized programs are executed on the endpoints in the network and there 
are no unauthorized devices communicating on the network. Neither security audit contracted by Maricopa County 
noted this discrepancy or finding in their report. 











6.5. 3SUBPOENAED EQUIPMENT NOT YET PROVIDED Uikelihood: = Medium — Impact: High 


SLI Compliance report page 11 states that the Maricopa County produced 6 EMS computers. Further analysis indicated 
that there were 4 EMS workstations and 2 EMS servers. Maricopa County only produced 1 EMS server and 4 EMS 
workstations despite the Arizona Senate subpoena requesting ALL EMS servers and systems utilized in the 2020 General 
Election. This has impacted the ability to complete the audit of the digital network and devices. For example, if malware 
was resident on the missing EMS or that machine was utilized in any manner to manipulate the results of the election; 
this would not be able to be determined from our analysis. 


6.5.3.1 INSTANCES 


6:53:11 Network Related Data 
The Arizona Senate Subpoena to the Maricopa County Board of Supervisors included the production of network 
routers, router configuration files and managed switches used in the 2020 General Election. In subsequent 
conversations with county officials and county attorneys between 4/22/21 and 4/30/21 these officials agreed to 
provide virtual access to the systems and to provide archived Splunk data beginning 60 days prior to the election and 
ending 90 days following the election. Maricopa County refused to provide any data citing that the production of the 
router data would compromise ongoing law enforcement operations and the personally identifying information (PII) of 
Maricopa County residents. Maricopa County and the Arizona State Senate recently settled their dispute regarding 
outstanding subpoena items, so this portion of the audit is not yet complete. 

















6.5.3.1.2 Poll Worker Laptops 
Despite the presence of at least one poll worker laptop at each voting center, the auditors did not receive laptops or 
forensic copies of their hard drives. It is unknown, due to the lack of this production, whether there was unauthorized 
access, malware present or internet access to these systems. 
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6:5.3.1;3 ImageCast Precinct (ICP) Administrator Credentials and Hardware Tokens 











Maricopa County utilized the Dominion ImageCast Precinct 2 (ICP2) tabulator during the General 2020 election. These 
tabulators are normally configured with cellular wireless connections, Wi-Fi access and multiple wired LAN 
connections. The ICP2 actually requires two forms of authentication to configure, check and/or access the device, a 
numerical password and an iButton token. Maricopa County produced iButton credentials for Poll Workers to open 
and close polls on the ICP2’s but did not produce any credentials to access the higher level administrative or 
configuration settings for the tabulators. This prevented the verification of the ICP2 settings to include the cellular 
wireless settings, the local area network settings, the wide area network settings and access to the administrative 
configuration reporting functions. During the course of the examination, we were able to recover the higher-level 
admin’s numerical password from the EMS SQL Database. We also attempted to create administrative level iButton 
credentials utilizing the EMS system forensic images mounted in a Virtual Machine (VM) environment. The VM of the 
EMS system was fully functional and was used to produce poll worker iButton credentials, however, the EMS did not 
have the ability to create the administrative ICP2 credential. 


The EMS, as produced to the auditors, only had the Poll Worker role programmed into EMS. The Poll Worker role did 
not have the necessary privileges and functionality to create an administrative iButton credential. In their response to 
the Arizona Senate request for the administrative ICP2 iButton credentials, the Maricopa County officials indicated that 
they did not possess these credentials and only the contracted Dominion employees have access to these credentials. 
Dominion has refused to comply with the production request. Given the inability to create administrative tokens with 
the EMS and the statement by Maricopa County concerning the ownership of the administrative iButtons, Maricopa 
County is unable to validate tabulator configurations and independently validate the voting system prior to an election. 
Additionally, since Maricopa County does not control the administrative iButtons, Maricopa County is apparently 
unable to independently configure, validate the voting systems prior to an election, or satisfactorily freeze the 
configuration of the systems for the required time periods during an election. If only the vendor controls the 
administrative iButtons, Maricopa County has no way of checking the configuration of the tabulators. 





6.5.3.1.4 IPX and Other Devices 
Based on the videos of the Maricopa County Tabulation and Election Center (MCTEC) there are a significant quantity of 
systems that were used in the voting process for the 2020 General Election that were not produced, including the 
items pictures below. 
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Figure 16-Video Taken on 8 November 2020 of Maricopa County ICX Systems 


Figure 17-Video Capture Taken from Maricopa County Live Stream 
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6.5.3.1.5 Other Devices Connected to the Election Network 
Examination of the network configurations for the produced systems determined that the programmed gateway for all 
the systems was This normally refers to the network router used to route network traffic external to 
the This device could also have been a managed switch. In either case, the device was not 
produced. The DNS cache has an entry or i with an IP address of a. indicating that 
this system had been communicated with the EMS server and was probably used for printing. Given the naming 
convention of the device, MCTEC is the acronym for the Maricopa County Tabulation and Election 
Center. This device has not been produced by Maricopa County. Therefore, there are additional network components 
that the county has not acknowledged and that are in tension with the public statements made by the county that the 
election system did not have any routers and was completely isolated from the internet. 


















Figure 18-DNS Update Table Recovered from the Maricopa County EMS. 
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Figure 19-Default Gateway Settings 


6.5.4 ANONYMOUS LOGINS Likelihood: © Medium Impact: Medium 


There are common functions in Microsoft Windows that will record an anonymous login activity into the windows 
security logs. These logins, however, exhibit known recording sequences within the logs that allow analysts to determine 
the origination of the requesting function and determine the legitimacy of the logged action. An example of this 
behavior is the windows response to a request to access a Windows Server Message Block (SMB) share, also known as a 
network drive. When a user requests a connection to network drive, that initial connection request is logged as an 
anonymous user. The log entry also records the requestor’s host name and the requestor’s IP address. That anonymous 
request is then immediately followed up with another logged entry that authenticates the user’s actual username and 
password in order to grant access. Below is a screen shot of this normal windows activity. Notice that the workstation 
name, source network IP and source port fields of this log entry contains valid data. This log entry is immediately (within 
one second) followed by the successful authentication of the username that is authenticating to the network drive for 
access permissions. That subsequent user authentication is also logged. 
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Figure 20-Normal Anonymous Request to SMB Share 


While the Windows security logs from the Maricopa County EMS server only are present from 2/5/21 to 4/12/21, there 
are a significant number of atypical remote, anonymous logins contained in the Windows security logs. Below is an 
example of the atypical anonymous logons. Note that this is a remote login (login I. Note that the Workstation 
Name, Source Network Address and Source Port log elements are not populated, and that root/system level access is 
granted. It is normal for logins from the local system (login type to not populate these data fields, but the 
fact that it is a network remote login (login type 3), and the fields are not populated is irregular and indicates that this is 
not a typical anonymous login. A search of the event logs from other Windows 2012 R2 servers did not reveal a single 
logon type anonymous log entry that did not record these log data elements. 





Figure 21-Atypical Remote Anonymous Access to EMS Server 
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Without access to the network data, it is impossible to determine the origin of these successful atypical remote 
anonymous logons. The fact that there effectively was no user account and password controls resulting in shared user 
accounts and passwords, coupled with the lack of network data, makes it impossible to determine if these accesses were 
legitimate or unauthorized without the network data. This portion of the audit is therefore not yet complete. 


6.5.5DUAL Boor SYSTEM DISCOVERED Likelihood: © Medium Impact: Medium 


Analysis of the system labeled Adjudication 2 (CyFIR evidence designation AZAud-E-087) revealed that this system 
contained two bootable hard drives. These two hard drives were subsequently labeled One of the AZAud-E-087-1 and 
AZAud-E-087-2. Neither security audit contracted by the Maricopa County noted this finding in their report. 


7.5.5.1 ANALYSIS OF AZAUD-E-087-1 DETERMINED THE FOLLOWING: 


Configured to communicate with an SMTP server address of in the Dominion Voting Systems 
NLog.config file. Note: the nslog.config files on this system also contained clear text passwords, one of which 
was the password for the emsdbadmin account. 


7.5.5.2 ANALYSIS OF AZAUD-E-087-2 DETERMINED THE FOLLOWING: 





The discovery of a system with a dual boot configuration is a significant finding. First, it demonstrates a failure in the 
hardware configuration management of the Maricopa County election systems. Second, two bootable hard drives 
within the same system, under certain circumstances would create a situation where one operating system could act as 
a “jump box” where one system could access the internet and the other system would be restricted to an isolated 
network. This is commonly called a dual homed access and could have provided an access route into the voting system 
network. Without the router data, historical Splunk data and NetFlow data, we cannot complete the full analysis of the 
impact of this dual boot computer. Neither of the two audits performed by Maricopa County detected or reported this 
additional, bootable hard drive on the Adjudication 2 system. 
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6.5.6EMS OPERATING SYSTEM LOGS NOT PRESERVED likelihood: = Low Impact: High 


The Windows event logs that were present on the EMS Server that was produced by Maricopa County contain Windows 
security event logs mm. This file records the Windows operating security events for the EMS server including 
all user accesses, whether those accesses are from the local system itself or from accessing the system remotely. This 
log file was restricted by a policy set by Maricopa County to a file size of 20,480KB (20MB). The logging activity was set 
to automatically overwrite the existing log entries if the security file exceeded this size. The overwrite action would 
write a new log entry and delete the oldest entry in the log file. In the case of the security.evtx file on the EMS server, 
the earliest retained log entry was dated 2/5/2021 10:37:49 AM (the last day of the Pro V & V audit) and the latest entry 
was dated 4/12/2021 4:53:16 PM. The logs were not preserved and did not cover the dates for the general election (3 
November 2020). An examination of the EMS and other systems involved in the 2020 General Election did not discover 
any enabled external log aggregation functionality nor were historical logs beyond those that were contained on the 
operating systems provided to the digital examination team. The security access logs were not preserved and were 
overwritten. 
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Enable logging 
Maximum log size ( KB 
\When maximum event log size is reached: 

© Overwrite events as needed (oldest events first) 


Archive the log when full, do not overwrite events 


Do not overwrite events (Clear logs manually 





Figure 22-Policy Settings EMS Security.evtx 





6.5.6.1.1 User Log Deletions on 2/11/2021 


Auser leveraging the emsadmin account remotely logged into the EMS server at 2/11/2021 9:08:27 AM via terminal 
services and began executing a script at 2/11/2021 9:09:04 AM that checked accounts for blank passwords. The event 
logs record this connection as originating from a system with the IPV6 address iii. which 
is a local network IPV6 address. Between 2/11/2021 8:09:04 AM and 2/12/2021 7:12:55 AM this user ran this check 
462 times. Each time the check was performed a new line was added to the security log, which had the effect of 
deleting the oldest entry in the log file due to the previously mentioned log size limitation setting. 462 older log entries 
were deleted via this method. 


Auser utilizing the emsadmin account remotely logged into the EMS server at 3/3/2021 11:12:31 AM and began 
executing a script at 3/3/2021 11:13:44 AM that checked accounts for blank passwords. The event logs record this 
connection as originating from a system with the IPV6 address of a. which is a valid IPV6 local network 
address. Between 3/3/2021 11:12:31 AM and 3/5/2021 7:58:04 AM this user ran the script 37,686 times. Each time 
the check was performed a new line was added to the security log, which had the additional effect of deleting the 
oldest entry in the log file due to the previously mentioned log size limitation setting. 37,468 older log entries were 
deleted via this method. 











This was 14 days after the Arizona State Senate described the risk of evidentiary loss due to continued use of election 
equipment, and 6 days after Judge Thomason ruled that the subpoena needed to be complied with. 
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Figure 23-3 Identified but Unnamed Individuals at the keyboard at 3/3/2021 at 11:06AM 





6.5.6.1.3 User Log Deletions on 4/12/2021 
A user utilizing the emsadmin account began executing a script at 4/12/2021 1:39:38 PM to check accounts for blank 
passwords. Between 4/12/2021 12:39:38 PM and 4/12/2021 12:45:13 PM this user ran this check 330 times. Each 
time the check was performed a new line was added to the security log, which had the additional effect of deleting the 
oldest entry in the log file due to the afore mentioned log size limitation setting. 330 older log entries were deleted via 
this method. 
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Figure 24- County Employee at the EMS Keyboard on 4/12/2021 at 12:39PM 
the time of the last blank password check was run. 
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7.5.5 INTERNET CONNECTIONS Likelihood: Medium Impact: Medium 


The Maricopa County Board of Supervisors has repeatedly stated that the network connecting the election /voting 
systems is an isolated network that has no ability to connect to the internet. An in-depth analysis of both the allocated 
and unallocated space of the EMS, EMS workstations, Adjudication Workstations and other elements of the election 
system has definitively proven that this is not the case. There were hundreds of connections to public internet sites 
recovered from the unallocated areas of the hard drives. For the purpose of this report, only internet connection 
artifacts that contained valid dates after the installation of the Dominion Software suite on 8/6/2019 were included in 
this report. Additionally, for the purposes of this report only sites that have been visited multiple times were reported 
to avoid false reporting of default internet histories. Given that the Dominion Software suite was installed on 8/6/2019, 
no internet history URL visit dates should exist after that date. 


The county did not provide a network diagram, a function diagram or any other documentation to determine if in fact a 
given system was supposed to be connected to the internet. Public statements by the county made clear that no 
election related system was connected to the internet. For the purposes of the internet examination, auditors used this 
statement as the starting point to prove or disprove that there was internet connectivity accessible to the systems 
provided by the county as a result of the subpoena. In the course of the examination definitive evidence was recovered 
that the EMS, EMS Client 1, EMS Client 3, EMS Client 4, REWEB 1601, and the REGIS 1202 systems had access to the 
internet after the installation of the Dominion voting software suite was installed on 8/6/2019. Given the nature of 
unallocated space analysis this is by no means a complete recovery of all internet history, but is definitive for the 
recovered internet artifacts on the dates and times indicated. 


6.5.6.2 INTERNET CONNECTIONS TO THE EMS 


The EMS Server had 3 connections on 2/2/2021 to the i 





6.5.6.3 INTERNET CONNECTIONS TO THE EMS CLIENT 1 


The EMS Client 1 had 9 Connections to the internet between 2/7/2020 and 2/22/2021, specifically to the 
go.microsoft.com and www.bing.com URL's. 





In addition to the HTTP(S) connections, there were 51 records recovered that contained 143 connections to an internal 
device that was not produced by Maricopa County with an IP address of 
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6.5.6.4 INTERNET CONNECTIONS TO THE EMS CLIENT 3 
The EMS Client 3 had 6 Connections to the internet to the go.microsoft.com URL. 





6.5.6.5 INTERNET CONNECTIONS TO THE REWEB 1601 System 

The county provided what was represented as a “forensic image” of the system with the hostname SS - This in 
fact was not an actual forensic image, but rather a copy of the hard drive on a 4TB external drive. It is unknown what 
actions were taken by the County to ensure that the drive was wiped prior to the system copy. A carve for internet 
history artifacts recovered 890 internet records, each with multiple visit iterations for public URL connections including 
foxnews.com, maricopa.gov, Microsoft.com, msn.com and adnxs.com. 
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6.5.6.6 INTERNET CONNECTIONS TO THE REGIS 1202 SysTem 

The county provided what was represented as a “forensic image” of the system with the hostname REGIS 1202. This in 
fact was not an actual forensic image, but rather a copy of the hard drive on a 4TB external drive. It is unknown what 
actions were taken by the County to ensure that the drive was wiped prior to the system copy. A carve for internet 
history artifacts recovered 205 internet records, each with multiple visit iterations for public URL connections including 
maricopa.gov, Microsoft.com, and logons to the localhost. 
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7.6 Low Findings 





7.6. 1ELECTION DATA FOUND FROM OTHER STATES likelihood: = Low Impact: Medium 


The Maricopa County Adjudication 2 system had two bootable hard drives. The drive identified as 
contains a directory J. Inside of that directory are subdirectories that appear to contain data from other 
jurisdictions and what appears to be demonstration data. Specifically, these directories are named 







. One can reasonably assume that WA is an abbreviation for Washington and SC is an 
abbreviation for South Carolina. There is no known need for this external data to be located on a Maricopa County 
adjudication system. Neither of the two audits performed by Maricopa County reported this finding. 
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Figure 26-General with Variable SP Directory 
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Figure 27-SC Cert Cookie General Directory Structure 
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Special Election with Fusion Directory 


Figure 28 - WA Cert General 2018 vA Directory 
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7 ABOUT CYBER NINJAS 





Cyber Ninjas is an application security consulting company specializing in ethical hacking, training, and security program 
development. Our staff represents over 10 years of experience in a variety of areas including application support, 
development, product management, and application security. This experience across all areas of the software 
development life cycle gives us a unique perspective on how to build security into your existing processes. With 
everything we do, our goal is to build the knowledge within your organization. We strongly believe that "Security comes 
with knowledge,” and that it is our job as Cyber Ninjas to train and teach through every engagement to build up 
capabilities within your organization. 
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